Data transmission method for nuclear power physical protection communication, device, and medium

Abstract

A data transmission method for nuclear power physical protection communication comprises: negotiating with a second terminal to obtain a preset session key; performing encryption processing of a first algorithm on original preset key data to obtain a first digest; performing encryption processing of a second algorithm on the first digest on the basis of a preset private key to obtain a first digital signature; performing encryption processing of a third algorithm on the first digital signature and the original preset key data to obtain an encrypted data packet, and sending the encrypted data packet to the second terminal; and performing encryption processing of a fourth algorithm on original data on the basis of the original preset key data to obtain target data, and transmitting the target data to the second terminal.

Description

Data transmission method, device and medium for nuclear power protection communication Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a data transmission method, device, and medium for nuclear power plant security communication. Background Art

[0002] Nuclear power physical protection communication is a communication network system in the nuclear power industry that is independent of normal telephone and other communication systems. As an important communication subsystem of the nuclear power plant physical protection system, its main purpose is to ensure that the nuclear power plant security system has appropriate communication means and functions under any circumstances.

[0003] With technological advancements, communication security in the nuclear power industry is receiving increasing attention. As a crucial component of the industry, nuclear power plant security communications are experiencing an increasingly urgent need for encrypted communications. Currently, dedicated encrypted communication terminals for point-to-point communications, particularly those for nuclear power plant security communications, are still lacking.

[0004] Summary of the Invention

[0005] The purpose of the present disclosure is to provide a data transmission method, device and medium for nuclear power protection communication, so as to at least partially solve the above technical problems.

[0006] As a first aspect of the present disclosure, a data transmission method for nuclear power protection communication is provided, including: negotiating with a second terminal to obtain a preset session key; encrypting the original preset key data using a first algorithm to obtain a first summary; encrypting the first summary using a second algorithm according to a preset private key to obtain a first digital signature; encrypting the first digital signature and the original preset key data using a third algorithm to obtain an encrypted data packet and sending it to the second terminal; encrypting the original data using a fourth algorithm according to the original preset key data to obtain target data and transmitting it to the second terminal.

[0007] Optionally, negotiating with the second terminal to obtain a preset session key includes: generating a first random number; obtaining a first public value based on preset shared parameters and the first random number; sending the first public value to the second terminal; receiving a second public value from the second terminal, wherein the second public value is generated by the second terminal based on the preset shared parameters and the second random number; and obtaining the preset session key based on the first random number and the second public value.

[0008] Optionally, the original preset key data is encrypted using a first algorithm to obtain a first summary, including: performing message padding processing on the original preset key data to obtain first intermediate data; processing the first intermediate data through a compression function to obtain second intermediate data; the compression function is used to perform permutation function, permutation transformation and permutation calculation operations on the input data; and operating the second intermediate data with a preset initial hash value to obtain a first summary.

[0009] Optionally, the original data is encrypted using a fourth algorithm according to the original preset key data to obtain target data and transmit it to the second terminal, including: grouping the original data to obtain N groups of plaintext groups; N is a positive integer; using an encryption vector and the i-th plaintext group to encrypt to obtain the i-th ciphertext group; wherein, when i=1, the encryption vector is a preset initial vector, and when i>1, the encryption vector is a ciphertext group obtained by encrypting the (i-1)-th plaintext group; i is sequentially taken from 1 to N; the ciphertext group is sent to the second terminal; N of the ciphertext groups constitute the target data.

[0010] Optionally, using the encryption vector and the i-th plaintext group to encrypt to obtain the i-th ciphertext group includes: using the encryption vector and the i-th plaintext group to perform logical processing to obtain an intermediate encrypted group; encrypting the intermediate encrypted group according to the original preset key data to obtain the i-th ciphertext group.

[0011] As a second aspect of the present disclosure, a data transmission method for nuclear power protection communication is provided, including: negotiating with a first terminal to obtain a preset session key; receiving an encrypted data packet from the first terminal; performing decryption processing on the encrypted data packet using a third algorithm to obtain a second digital signature and intermediate preset key data; verifying the intermediate preset key data based on the second digital signature, and obtaining original preset key data when the verification passes; receiving target data from the first terminal; performing decryption processing on the target data using a fourth algorithm based on the original preset key data to obtain original data.

[0012] Optionally, negotiating with the first terminal to obtain a preset session key includes: generating a second random number; obtaining a second public value based on preset shared parameters and the second random number; receiving a first public value sent by the first terminal, wherein the first public value is generated by the first terminal based on the preset shared parameters and the first random number; sending the second public value to the first terminal; and obtaining the preset session key based on the second random number and the first public value.

[0013] Optionally, the intermediate preset key data is verified based on the second digital signature, and if the verification passes, the original preset key data is obtained, including: decrypting the second digital signature using a second algorithm based on the preset session key, and if the decryption is successful, obtaining a first summary; encrypting the intermediate preset key data using a first algorithm to obtain a second summary; and obtaining the original preset key data if the first summary is consistent with the second summary.

[0014] As a third aspect of the present disclosure, an electronic device is provided, comprising: one or more processors; a memory on which one or more programs are stored, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the data transmission method for nuclear power protection communication as described in any one of the first aspects or the data transmission method for nuclear power protection communication as described in any one of the second aspects; and one or more I / O interfaces connected between the processor and the memory, configured to implement information interaction between the processor and the memory.

[0015] As a third aspect of the present disclosure, a computer-readable storage medium is provided, which stores instructions. When the instructions are executed on a computer, the computer executes the data transmission method for nuclear power protection communication according to any one of the first aspects or the data transmission method for nuclear power protection communication according to any one of the second aspects.

[0016] In the data transmission method for nuclear power protection communication provided by the present disclosure, the first terminals of the two parties in the nuclear power protection communication use the negotiated preset session key as the identity authentication information between the two parties, generate a digital signature for identity verification based on the preset session key and the original preset key data, encrypt the digital signature and the original preset key data to obtain an encrypted data packet and transmit it, so that the second terminal can perform identity authentication and data integrity verification on the encrypted data packet, thereby filling the gap in encrypted communication of nuclear power protection communication, greatly improving the security of internal communication information transmission of nuclear power, avoiding security issues caused by data tampering, and ensuring the normal operation of nuclear power plants. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] FIG1 is a flow chart of a data transmission method for nuclear power protection communication provided by an embodiment of the present disclosure;

[0018] FIG2 is a flowchart of a negotiation process of a preset session key according to an embodiment of the present disclosure;

[0019] FIG3 is a flowchart of an encryption process of original data provided by an embodiment of the present disclosure;

[0020] FIG4 is a flowchart of another data transmission method for nuclear power protection communication provided by an embodiment of the present disclosure;

[0021] FIG5 is a flow chart of a transmission process of original preset key data provided by an embodiment of the present disclosure;

[0022] FIG6 is a flowchart of a target data decryption process according to an embodiment of the present disclosure;

[0023] FIG7 is a schematic structural diagram of an electronic device provided by an embodiment of the present disclosure;

[0024] FIG8 is a schematic diagram of the structure of a computer-readable medium provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] It should be understood that the specific embodiments described herein are only used to illustrate the present disclosure and are not intended to limit the present disclosure.

[0026] In the subsequent description, suffixes such as "module," "component," or "unit" used to represent elements are used only to facilitate the description of the present disclosure and have no specific meaning. Therefore, "module," "component," or "unit" may be used interchangeably.

[0027] The application scenario of the disclosed embodiments is nuclear power plant security communications, specifically the physical protection of nuclear power plants. In this scenario, dedicated encryption methods are lacking to protect intercom terminals, making communication security between the two parties in this scenario unreliable. In response to the specific circumstances and characteristics of nuclear power plant security communications, the disclosed embodiments provide a method involving key negotiation, encrypted key transmission, and encrypted data transmission to ensure data security during nuclear power plant security communications.

[0028] In a first aspect, an embodiment of the present disclosure provides a data transmission method for nuclear power protection communication, as shown in FIG1 , for a first terminal, the method comprising the following steps:

[0029] Step 101: Negotiate with the second terminal to obtain a preset session key.

[0030] Step 102: encrypt the original preset key data using a first algorithm to obtain a first digest.

[0031] Step 103: encrypt the first digest using a second algorithm according to a preset private key to obtain a first digital signature.

[0032] Step 104: encrypt the first digital signature and the original preset key data using a third algorithm to obtain an encrypted data packet and send it to the second terminal.

[0033] Step 105: encrypt the original data using a fourth algorithm according to the original preset key data to obtain target data and transmit the target data to the second terminal.

[0034] In an embodiment of the present disclosure, the data transmission method is used for the first terminal in a nuclear power protection communication scenario. The preset session key is obtained by negotiation between the first terminal and the second terminal communicating with it. The preset session key is uniquely determined by the first terminal and the second terminal, that is, any third party cannot determine the preset session key; the original preset key data is used to encrypt the original data to be transmitted to the second terminal. Before the original data is encrypted and transmitted, the first terminal encrypts the original preset key data and transmits it to the second terminal, so that the second terminal can decrypt the received original data according to the original preset key data; wherein, the preset private key matches the preset session key, and the preset session key can be used to decrypt the information encrypted by the preset private key to verify the digital signature signed by the preset private key.

[0035] The first algorithm is a message digest algorithm, which belongs to a hash algorithm. In some embodiments, the first algorithm can be an SM3 algorithm, whose hash value length is 32 bytes. The first algorithm can compress a message of any length into a digest of a fixed length. The digest is unique, and the digests generated by different information are different. The original information cannot be restored from the digest, and the same digest cannot be forged to obtain the same digest. The original preset key data is encrypted by the first algorithm to obtain a first digest. Even a second terminal cannot decrypt the first digest or restore it to the original preset key data.

[0036] The second algorithm is an asymmetric encryption algorithm, which encrypts the first digest using a preset private key. Since the preset session key is uniquely determined by the first terminal and the second terminal, the first digital signature obtained after encryption by the first terminal can be decrypted by the second terminal, which also knows the preset session key, to prevent data from being tampered with at will. In some embodiments, the second algorithm may be an SM2 algorithm, and the second algorithm is ECC (Ellipse Curve Ctyptography), which has an encryption strength of 256 bits. ECC has high computational complexity and is difficult to crack.

[0037] The third algorithm is a symmetric encryption algorithm, which is used to encrypt the first digital signature and the original preset key data to obtain an encrypted data packet, so that after the second terminal decrypts the encrypted data packet, it can authenticate the sending end (i.e., the first terminal) based on the first digital signature therein to prevent the encrypted data packet from being tampered with; in some embodiments, the third algorithm can be an SM1 algorithm, and the encryption strength of the third algorithm is 128 bits, which can be implemented in hardware, that is, the algorithm is integrated into the chip of the terminal to realize encryption.

[0038] The first terminals of both parties in the nuclear power protection communication use the negotiated preset session key as the identity authentication information between the communicating parties, generate a first digital signature for identity verification based on the preset session key and the original preset key data, encrypt the first digital signature and the original preset key data to obtain an encrypted data packet and transmit it, so that the second terminal can perform identity authentication and data integrity verification on the encrypted data packet, thereby filling the gap in encrypted communication of nuclear power protection communication, greatly improving the security of internal communication information transmission of nuclear power, avoiding security issues caused by data tampering, and ensuring the normal operation of nuclear power plants.

[0039] In some embodiments, negotiating with the second terminal to obtain a preset session key includes:

[0040] Generate a first random number; obtain a first public value based on preset shared parameters and the first random number; send the first public value to the second terminal; receive a second public value from the second terminal, wherein the second public value is generated by the second terminal based on the preset shared parameters and the second random number; and obtain a preset session key based on the first random number and the second public value.

[0041] In an embodiment of the present disclosure, a first terminal and a second terminal negotiate to determine a preset session key. The negotiation process is as follows: the first terminal and the second terminal both generate random numbers, i.e., the first terminal generates a first random number and the second terminal generates a second random number. A preset shared parameter exists between the first and second terminals, and the preset shared parameter can be publicly transmitted. The preset shared parameter serves as the basis for generating a public value and a preset session key. The first terminal calculates a first public value using the preset shared parameter and the first random number, and the second terminal calculates a second public value using the preset shared parameter and the second random number. The two terminals exchange the first and second public values. Both the first and second public values ​​can be publicly transmitted. Even if the first or second public values ​​and the preset shared parameter are obtained by a third party, the third party cannot deduce the random number based on them. Therefore, the preset session key can serve as an identity authentication identifier for both parties to the session. The first terminal obtains the preset session key based on the first random number and the second public value. Similarly, the first terminal obtains the preset session key based on the second random number and the first public value.

[0042] In one example, it is illustrated that the preset session keys obtained by both ends are the same: as shown in Figure 2, terminal A and terminal B negotiate the preset session key, terminal A generates a random number a, and terminal B generates a random number b. Through the shared parameter G shared between terminal A and terminal B, the public value A of terminal A is a*G, and the public value B of terminal B is b*G. The two ends exchange public values. Terminal A calculates the preset session key Q=a*B based on the random number a, where the public value B is b*G, so the preset session key obtained by terminal A is Q=a*B=a*(b*G); terminal B calculates the preset session key Q=b*A based on the random number b, where the public value A is a*G, so the preset session key obtained by terminal B is Q'=b*A=b*(a*G). It can be seen that the preset session keys obtained by both ends are the same.

[0043] It is worth noting that in some embodiments, the preset shared parameter is an elliptic curve base point. The determination of the preset shared parameter should satisfy that the preset shared parameter must be on the elliptic curve, and the order of the preset shared parameter (i.e., the number of times it returns to the starting point after adding it several times) should be a large prime number. In one example, the elliptic curve is y 2 =x 3 +ax+b(mod p), where p is a large prime number, and a and b are the parameters of the elliptic curve. The process of determining the base point of the elliptic curve is to find a point (x, y) on the elliptic curve, and check whether the order of the point is a large prime number, until a point with a large prime number and on the elliptic curve is found. The choice of order directly affects the security of the encryption process. When the order is a large prime number, the security of the encryption can be guaranteed.

[0044] Furthermore, in some embodiments, the process of encrypting and decrypting data based on the preset shared parameter, the first public value, and the second public value is as follows:

[0045] To encrypt the data M to be encrypted: Choose a random integer k and calculate the points C1 = kG and C2 = M⊕kP on the elliptic curve, where k is the first random number, G is the preset shared parameter, M is the data to be encrypted, ⊕ represents the exclusive-or operation, and P is the second public value. Calculate C3 = Hash(x||M||y). The resulting ciphertext is C = (C1, C3, C2). Here, "||" represents concatenation, and Hash(·) is the hash function.

[0046] Decrypt C = (C1, C3, C2): Calculate the point [dC1] on the elliptic curve, where [dC1] represents the multiplication of the preset session key d and the point C1 on the elliptic curve; perform an XOR operation on C2 using [dC1] to recover the original message M; calculate Hash(x||M||y) and compare it with C3. If they are equal, the decryption is successful.

[0047] Accordingly, in some embodiments, performing encryption processing on the original preset key data using a first algorithm to obtain a first digest includes:

[0048] The original preset key data is subjected to message padding processing to obtain first intermediate data; the first intermediate data is processed through a compression function to obtain second intermediate data; the compression function is used to perform permutation function, permutation transformation and permutation calculation operations on the input data; the second intermediate data is operated with a preset initial hash value to obtain a first summary.

[0049] In an embodiment of the present disclosure, the original preset key data is encrypted by a first algorithm; the original preset key data is message-filled, including: dividing the original preset key data into data blocks of a first preset number of bits, and filling each data block so that its length reaches the first preset number of bits. In some embodiments, the filling rule of the data block is to add "1" at the end of the message, add enough "0" to make the length of the data block meet the requirements, and add the length value of the original preset key data at the end, where the length value is the length information of the original preset key data represented by a second preset number of bits.

[0050] The first intermediate data obtained through message filling processing is several filled data blocks. Each data block is input into the compression function for processing. The compression function includes nonlinear permutation and bit operation (such as permutation function, permutation transformation and permutation calculation, etc.) to obtain the second intermediate data. The second intermediate data includes multiple processing results obtained by inputting multiple data blocks into the compression function and then processing them.

[0051] Before performing message filling processing on the original preset key data, the method further includes: defining an initial vector, which is a preset initial hash value, and sequentially computing multiple processing results of the second intermediate data with the preset initial hash value to obtain a first digest.

[0052] In some embodiments, encrypting the original data using a fourth algorithm according to the original preset key data to obtain target data and transmitting the target data to the second terminal includes:

[0053] The original data is grouped to obtain N groups of plaintext groups, where N is a positive integer; the encryption vector is used to encrypt the i-th plaintext group to obtain the i-th ciphertext group; wherein, when i=1, the encryption vector is a preset initial vector, and when i>1, the encryption vector is a ciphertext group obtained by encrypting the (i-1)-th plaintext group; i is sequentially selected from 1 to N; the ciphertext groups are sent to the second terminal; the N ciphertext groups constitute the target data.

[0054] In an embodiment of the present disclosure, the fourth algorithm is an algorithm for encrypting the original data group, which is a symmetric encryption algorithm. In some embodiments, the fourth algorithm can be an SM4 algorithm, and its encryption strength can be 128 bits. Among them, group encryption is to group the original plaintext data according to a pre-set fixed length, and encrypt them group by group using the same key determined by both ends (i.e., the original preset key data). When decrypting the ciphertext, the same key (i.e., the original preset key data) is also used to decrypt it group by group. Such an encryption and decryption algorithm has a simple implementation process, fast encryption speed, and low resource consumption, and is suitable for encrypting original data in static storage or data signal transmission channels.

[0055] Accordingly, in some embodiments, encrypting the i-th plaintext block using the encryption vector to obtain the i-th ciphertext block includes:

[0056] The encryption vector and the i-th plaintext group are logically processed to obtain an intermediate encrypted group; and the intermediate encrypted group is encrypted according to the original preset key data to obtain the i-th ciphertext group.

[0057] In the embodiments of the present disclosure, there is no limitation on the logical operation, which may be an XOR process or a linear transformation, etc., and may be set according to security requirements.

[0058] Referring to Figure 3 , the original plaintext data is divided into N groups. The first group of plaintext groups is logically processed with a preset initialization vector. The result of the logical processing is the first intermediate encrypted group. The intermediate encrypted group is encrypted using the original preset key data to obtain the first key group. The preset initialization vector is an initialization vector assigned when there is no key group that can participate in the logical processing before the first group of plaintext groups. The first terminal and the second terminal share the preset initialization vector so that the second terminal can also perform decryption based on the preset initialization vector. The second group of plaintext groups is logically processed with the key group. The result of the logical processing is the second intermediate encrypted group. The second intermediate encrypted group is encrypted using the original preset key data to obtain the second key group. The third group of plaintext groups is logically processed with the key group. The result of the logical processing is the third intermediate encrypted group. The third intermediate encrypted group is encrypted using the original preset key data to obtain the third key group. This process continues in this manner until all N groups of plaintext groups are encrypted. The N ciphertext groups constitute the target data, which is then sent to the second terminal.

[0059] In a second aspect, an embodiment of the present disclosure provides a data transmission method for nuclear power protection communication, as shown in FIG4 , for a second terminal, the method comprising:

[0060] Step 401: Negotiate with the first terminal to obtain a preset session key.

[0061] Step 402: Receive an encrypted data packet from the first terminal.

[0062] Step 403: Decrypt the encrypted data packet using a third algorithm to obtain a second digital signature and intermediate preset key data.

[0063] Step 404: Verify the intermediate preset key data according to the second digital signature. If the verification passes, obtain the original preset key data.

[0064] Step 405: Receive target data from the first terminal.

[0065] Step 406: Decrypt the target data using a fourth algorithm according to the original preset key data to obtain original data.

[0066] In an embodiment of the present disclosure, the data transmission method is used for the second terminal in a nuclear power protection communication scenario. The preset session key is obtained by negotiation between the second terminal and the first terminal communicating with it. The preset session key is uniquely determined by the first terminal and the second terminal, that is, any third party cannot determine the preset session key; the original preset key data is used to decrypt the received encrypted data packet. Before receiving the target data, the second terminal receives the encrypted original preset key data from the first terminal and decrypts the encrypted original preset key data so that the first terminal and the second terminal share the original preset key data.

[0067] The second terminal cannot determine whether the second digital signature and the intermediate preset key data obtained after decrypting the encrypted data packet are tamper-proof and secure before verifying the second digital signature and the intermediate preset key data. The intermediate preset key data is verified based on the second digital signature. Accordingly, in some embodiments, the intermediate preset key data is verified based on the second digital signature. If the verification passes, the original preset key data is obtained, including:

[0068] According to the preset session key, the second digital signature is decrypted using a second algorithm, and if the decryption is successful, a first summary is obtained; the intermediate preset key data is encrypted using the first algorithm to obtain a second summary; if the first summary and the second summary are consistent, the original preset key data is obtained.

[0069] 5 , in the embodiment of the present disclosure, the second digital signature is decrypted using a second algorithm. Specifically, the second algorithm decryption is performed by using a preset session key as a public key corresponding to a preset private key to decrypt the second digital signature. If the decryption is successful, it indicates that the source of the encrypted data packet is legal, and the first summary is obtained by decryption. If the decryption is unsuccessful, it indicates that the encrypted data packet does not come from a legal first terminal, and the encrypted data packet should be discarded.

[0070] The intermediate preset key data is encrypted using the first algorithm to obtain a second digest; here, the first algorithm encryption process of the intermediate preset key data at the second terminal is exactly the same as the first algorithm encryption process of the original preset key data at the first terminal; when the intermediate preset key data is completely consistent with the original preset key data, the digests obtained by encrypting the two using the first algorithm will also be exactly the same, so by comparing the first digest and the second digest, if the two are consistent, it can be determined that the intermediate preset key data is consistent with the original preset key data, that is, it has not been tampered with; if the two are inconsistent, it can be determined that the intermediate preset key data is inconsistent with the original preset key data and needs to be discarded.

[0071] It is worth noting that since there is no decryption means for the first algorithm, even a terminal that knows the first algorithm cannot decrypt it through inverse operations. Therefore, it is extremely difficult to tamper with the intermediate preset key data and / or the second digital signature to ensure that the corresponding summaries of the two after tampering are consistent, thereby reducing the risk of data tampering.

[0072] Referring to Figure 5, in some embodiments, user A corresponds to terminal A, user B corresponds to terminal B, the original preset key data is used as the data to be sent, terminal A of user A generates summary A through hash operation, and in the identity authentication stage, summary A is encrypted by the pre-negotiated private key to obtain a digital signature; terminal A packages the data to be sent and the digital signature and encrypts them using a third algorithm to obtain an encrypted data packet, and sends the encrypted data packet to terminal B corresponding to user B.

[0073] The pre-negotiated private key is a preset session key generated using the second algorithm during the key negotiation phase. Specifically, each party in the conversation generates its own random number and calculates a public value from the random number and elliptic curve parameters. Each party then transmits the public value to the other party in a public manner. The terminal then calculates its own random number with the other party's public value, and both parties obtain the same session key, thus concluding the key negotiation process. This preset session key is uniquely determined by Terminal A and Terminal B and cannot be obtained by a third party. Therefore, this preset session key can serve as an identity authentication identifier for both parties in the conversation.

[0074] During the data transmission phase, after receiving the encrypted data packet from terminal A, terminal B decrypts it, obtaining the digital signature and data in the encrypted data packet. The same hash operation is then performed on the data to generate digest A'. The digital signature in the encrypted data packet is decrypted using the public key. If the decryption is successful, the source of the digital signature can be proven legitimate, i.e., it is authenticated by implementing the agreed public and private keys to obtain digest A. If the decryption is unsuccessful, the source of the digital signature is proven to be illegitimate, and the encrypted data packet needs to be discarded. At this point, terminal B completes the packet integrity check on the encrypted data packet.

[0075] If the decryption is successful, the digest A is further compared with the digest A'. If the two are consistent, the data is proven to be complete. If the two are inconsistent, it means that the data in the encrypted data packet has been tampered with and needs to be discarded.

[0076] In some embodiments, negotiating with the first terminal to obtain a preset session key includes:

[0077] Generate a second random number; obtain a second public value based on a preset shared parameter and the second random number; receive a first public value sent by the first terminal, wherein the first public value is generated by the first terminal based on the preset shared parameter and the first random number; send the second public value to the first terminal; and obtain a preset session key based on the second random number and the first public value.

[0078] As shown in FIG2 , in an embodiment of the present disclosure, a first terminal and a second terminal negotiate to determine a preset session key. The negotiation process is as follows: the first terminal and the second terminal both generate random numbers, i.e., the first terminal generates a first random number and the second terminal generates a second random number. A preset shared parameter exists between the first terminal and the second terminal, which can be publicly transmitted. The preset shared parameter is the basis for generating a public value and a preset session key. The first terminal calculates a first public value using the preset shared parameter and the first random number, and the second terminal calculates a second public value using the preset shared parameter and the second random number. The two terminals exchange the first public value and the second public value. Both the first public value and the second public value can be publicly transmitted. Even if the first public value or the second public value and the preset shared parameter are obtained by a third party, the third party cannot deduce the random number based on them. The first terminal obtains the preset session key based on the first random number and the second public value. Similarly, the first terminal obtains the preset session key based on the second random number and the first public value.

[0079] Accordingly, in some embodiments, the target data is composed of N ciphertext groups; performing a decryption process on the target data using a fourth algorithm according to the original preset key data to obtain the original data includes:

[0080] Decryption is performed using the decryption vector and the j-th ciphertext block to obtain the j-th plaintext block; when j=1, the decryption vector is a preset initial vector, and when j>1, the decryption vector is a plaintext block obtained by decrypting the (j-1)-th ciphertext block; j is sequentially taken from 1 to N; the N plaintext blocks constitute the original data.

[0081] In some embodiments, decrypting the jth ciphertext block using the decryption vector to obtain the jth plaintext block includes:

[0082] The j-th ciphertext block is decrypted according to the original preset key data to obtain the j-th intermediate decrypted block; and the decryption vector is used to perform a logical inverse process on the j-th intermediate decrypted block to obtain the j-th plaintext block.

[0083] In the embodiments of the present disclosure, there is no limitation on the logical inverse operation. The logical inverse operation is the inverse operation of the logical processing, which can be the inverse operation of the XOR processing, or the inverse operation of the linear transformation, etc., and can be set according to the security requirements.

[0084] 6 , the target data received by the second terminal includes N groups of ciphertext groups. The first group of ciphertext groups is decrypted using the original preset key data to obtain the first intermediate decrypted group. The intermediate decrypted group is subjected to a logical inverse process with the preset initial vector, resulting in the first plaintext group. The preset initial vector is an initial vector assigned when there is no plaintext group that can participate in the logical inverse process before the first group of ciphertext groups. The first terminal and the second terminal share the preset initial vector. The second group of ciphertext groups is decrypted using the original preset key data to obtain the second intermediate decrypted group. The intermediate decrypted group is subjected to a logical inverse process with the first plaintext group, resulting in the second plaintext group. The third group of ciphertext groups is decrypted using the original preset key data to obtain the third intermediate decrypted group. The intermediate decrypted group is subjected to a logical inverse process with the second plaintext group, resulting in the third plaintext group. This process is deduced in this way until the decryption process of all N groups of ciphertext groups is completed, and the N plaintext groups constitute the original data.

[0085] The first terminals of both parties in the nuclear power protection communication use the negotiated preset session key as the identity authentication information between the communicating parties, generate a digital signature for identity verification based on the preset session key and the original preset key data, encrypt the digital signature and the original preset key data to obtain an encrypted data packet and transmit it, so that the second terminal can authenticate the encrypted data packet and verify the data integrity, thereby filling the gap in encrypted communication in nuclear power protection communication, greatly improving the security of internal communication information transmission in nuclear power, avoiding security issues caused by data tampering, and ensuring the normal operation of nuclear power plants.

[0086] In a third aspect, an embodiment of the present disclosure provides an electronic device, as shown in FIG7 , comprising:

[0087] One or more processors 701; a memory 702, on which one or more programs are stored. When the one or more programs are executed by the one or more processors, the one or more processors implement the data transmission method for nuclear power protection communication as described in any one of the first aspects above or the data transmission method for nuclear power protection communication as described in any one of the second aspects above; one or more I / O interfaces 703, connected between the processor and the memory, and configured to implement information interaction between the processor and the memory.

[0088] Among them, the processor 701 is a device with data processing capabilities, including but not limited to a central processing unit (CPU); the memory 702 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically such as SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and flash memory (FLASH); the I / O interface 703 (read-write interface) is connected between the processor 701 and the memory 702, and can realize information exchange between the processor 701 and the memory 702, including but not limited to a data bus (Bus), etc.

[0089] In some embodiments, the processor 701 , the memory 702 , and the I / O interface 703 are connected to each other via a bus 704 , and further connected to other components of the computing device.

[0090] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, as shown in FIG8 , storing instructions, which, when executed on a computer, enables the computer to execute a data transmission method for nuclear power protection communication according to any one of the first aspects or a data transmission method for nuclear power protection communication according to any one of the second aspects.

[0091] The present disclosure adopts the above technical solution, and the communicating parties in the nuclear power protection communication process encrypt and transmit data according to a determined key, wherein the key is uniquely determined in advance by the communicating parties, filling the gap in encrypted communication in nuclear power protection communication, improving the security of nuclear power internal communication information transmission, and ensuring the normal operation of the nuclear power plant.

[0092] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0093] In a hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or temporary media). As is well known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. Furthermore, as is well known to those skilled in the art, communication media typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0094] The preferred embodiments of the present disclosure are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present disclosure. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present disclosure shall fall within the scope of the present disclosure.

Claims

1. A data transmission method for nuclear power protection communication, comprising: Negotiate with the second terminal to obtain a preset session key; Performing encryption processing on the original preset key data using a first algorithm to obtain a first summary; Perform encryption processing on the first summary using a second algorithm according to a preset private key to obtain a first digital signature; Encrypt the first digital signature and the original preset key data using a third algorithm to obtain an encrypted data packet and send the encrypted data packet to the second terminal; The original data is encrypted using a fourth algorithm according to the original preset key data to obtain target data and transmit it to the second terminal.

2. The data transmission method for nuclear power protection communication according to claim 1, wherein: Negotiating with the second terminal to obtain a preset session key includes: generating a first random number; Obtaining a first public value according to a preset shared parameter and the first random number; sending the first public value to the second terminal; Receive a second public value from the second terminal, wherein the second public value is generated by the second terminal according to the preset sharing parameter and a second random number; A preset session key is obtained according to the first random number and the second public value.

3. The data transmission method for nuclear power protection communication according to claim 1, wherein: The original preset key data is encrypted using a first algorithm to obtain a first summary, including: Performing message filling processing on the original preset key data to obtain first intermediate data; Processing the first intermediate data through a compression function to obtain second intermediate data; the compression function is used to perform permutation function, permutation transformation and permutation calculation operations on the input data; The second intermediate data is operated with a preset initial hash value to obtain a first summary.

4. The data transmission method for nuclear power protection communication according to claim 1, wherein: Performing encryption processing on the original data using a fourth algorithm according to the original preset key data to obtain target data and transmitting the target data to the second terminal includes: The original data is grouped to obtain N groups of plaintext groups, where N is a positive integer; Encrypt the i-th plaintext block using the encryption vector to obtain the i-th ciphertext block; wherein, when i=1, the encryption vector is a preset initial vector, and when i>1, the encryption vector is a ciphertext block encrypted using the (i-1)-th plaintext block; i is sequentially selected from 1 to N; The ciphertext group is sent to the second terminal; N of the ciphertext groups constitute the target data.

5. The data transmission method for nuclear power protection communication according to claim 4, wherein: The encryption vector is used to encrypt the i-th plaintext group to obtain the i-th ciphertext group, including: Use the encryption vector and the i-th plaintext group to perform logical processing to obtain an intermediate encrypted group; The intermediate encrypted block is encrypted according to the original preset key data to obtain the i-th ciphertext block.

6. A data transmission method for nuclear power protection communication, comprising: Negotiate with the first terminal to obtain a preset session key; receiving an encrypted data packet from the first terminal; Performing a decryption process on the encrypted data packet using a third algorithm to obtain a second digital signature and intermediate preset key data; Verifying the intermediate preset key data according to the second digital signature, and obtaining the original preset key data if the verification passes; receiving target data from the first terminal; The target data is decrypted using a fourth algorithm according to the original preset key data to obtain original data.

7. The data transmission method for nuclear power protection communication according to claim 6, wherein: Negotiating with the first terminal to obtain a preset session key includes: generating a second random number; Obtaining a second public value according to the preset shared parameter and the second random number; Receiving a first public value sent by the first terminal, wherein the first public value is generated by the first terminal according to the preset shared parameter and a first random number; sending the second public value to the first terminal; A preset session key is obtained according to the second random number and the first public value.

8. The data transmission method for nuclear power protection communication according to claim 6, wherein: According to the second digital signature, the intermediate preset key data is verified, and when the verification passes, the original preset key data is obtained, including: According to the preset session key, decrypt the second digital signature using a second algorithm, and obtain a first summary when the decryption is successful; Performing encryption processing on the intermediate preset key data using a first algorithm to obtain a second digest; When the first digest is consistent with the second digest, the original preset key data is obtained.

9. An electronic device, comprising: one or more processors; A memory having one or more programs stored thereon, when the one or more programs are executed by the one or more processors, the one or more processors implement at least one of the following methods: The data transmission method for nuclear power protection communication according to any one of claims 1 to 5; The data transmission method for nuclear power protection communication according to any one of claims 6 to 8; One or more I / O interfaces are connected between the processor and the memory and are configured to implement information interaction between the processor and the memory.

10. A computer-readable storage medium storing instructions, which, when executed on a computer, cause the computer to perform at least one of the following methods: The data transmission method for nuclear power protection communication according to any one of claims 1 to 5; A data transmission method for nuclear power protection communication according to any one of claims 6 to 8.

Images