Data transmission method and device, data transaction terminal, data provider

Abstract

A data transmission method and device, a data transaction terminal, a data supplier and a data demander, the method comprising: receiving first cipher data and first digital signature data from a data supplier, wherein the first cipher data and the first digital signature data are encrypted according to a trusted public key; verifying the first digital signature data; if the verification is passed, decrypting the first cipher data; wherein the first digital signature data is verified and the first cipher data is decrypted according to a trusted private key; a trusted public-private key pair including the trusted public key is generated by a data transaction terminal in a trusted computing environment, and then the trusted public key is sent to the data supplier. The application can provide a safe, controllable and trusted computing environment for computing or modeling analysis, and effectively improve the security of data transmission.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a data transmission method and device, data transaction terminal, data provider and data requester. BACKGROUND

[0002] In the era of big data, data is increasingly becoming an asset that can be traded, and the data requester obtains the required result data by purchasing the data usage right of the data provider and performing calculation or modeling analysis on the original data. In order to maximize the interests of both parties in data transaction, a trusted computing environment needs to be provided for the data requester to perform calculation or modeling on the data. The trusted computing environment is a fully closed operation area, so that the processing of data by the data requester in the environment is safe and controllable, and the data is protected from leakage or tampering. In addition, it is also necessary to ensure the secure transmission of original data and result data between the data provider and the data requester.

[0003] In the prior art, data transmission between mobile terminals is usually carried out in a point-to-point manner, i.e. the first terminal directly transmits data to the second terminal. For example, in data transaction, the terminal of the data provider directly transmits the original data to the terminal of the data requester, and the data requester performs modeling analysis on the original data obtained on its own platform to obtain the result data and achieve the use purpose. However, since the limitation on the data requester in this way cannot effectively reach the target, it cannot prevent the data requester from intentionally or unintentionally leaking, exceeding the authority to process and use the data, and the controllability is low. In addition, this simple and direct data transmission method lacks security, because the original data provided by the data provider and the result data obtained by the data requester after calculation or modeling are easily leaked, stolen, tampered with, etc. during the transmission process, resulting in damage to the interests of both parties in data transaction.

[0004] Therefore, there is an urgent need for a data transmission method that can provide a safe, controllable and trusted computing environment for the data requester to perform calculation or modeling analysis on the data, and effectively improve the security of data transmission. SUMMARY

[0005] One of the purposes of the present application is to provide a data transmission method and device, data transaction terminal, data provider and data requester, which can provide a safe, controllable and trusted computing environment for the data requester to perform calculation or modeling analysis on the data, and effectively guarantee the security of data transmission.

[0006] To achieve the above object, the embodiment of the present application provides a data transmission method, comprising the following steps: receiving first cipher data and first digital signature data from a data provider, wherein the first cipher data and the first digital signature data are encrypted according to at least a trusted public key; verifying the first digital signature data; if the verification is passed, decrypting the first cipher data; wherein the verification of the first digital signature data and the decryption of the first cipher data are performed according to at least a trusted private key; a trusted public-private key pair containing the trusted public key is generated by a data transaction terminal in a trusted computing environment, and then the trusted public key is sent to the data provider.

[0007] Optionally, the first cipher data is obtained by encrypting original data by using the trusted public key; the first digital signature data is obtained by encrypting the first cipher data by using a first private key to obtain first initial encrypted data, and then encrypting the first initial encrypted data by using the trusted public key; wherein the first private key is generated by the data provider.

[0008] Optionally, the verification of the first digital signature data according to at least the trusted private key comprises: performing a hash operation on the first cipher data by using a hash algorithm SM3 to obtain a first hash value; decrypting the first digital signature data by using a first public key to obtain first initial decrypted data, and then decrypting the first initial decrypted data by using the trusted private key to obtain first decrypted data; comparing whether the first hash value and the first decrypted data are completely same; if they are completely same, the verification is passed; wherein the first public key is generated by the data provider.

[0009] Optionally, the decryption of the first digital signature data by using the first public key to obtain first initial decrypted data, and then decrypting the first initial decrypted data by using the trusted private key to obtain first decrypted data comprises: decrypting the first digital signature data by using the first public key and an asymmetric encryption algorithm SM2 to obtain the first initial decrypted data; and then decrypting the first initial decrypted data by using the trusted private key and the asymmetric encryption algorithm SM2 to obtain the first decrypted data.

[0010] Optionally, before the decryption of the first digital signature data by using the first public key, the method further comprises: receiving the first public key from the data provider.

[0011] Optionally, the decryption of the first cipher data according to at least the trusted private key comprises: decrypting the first cipher data by using the trusted private key and the asymmetric encryption algorithm SM2.

[0012] Optionally, after the first ciphertext data is decrypted, the method further comprises: sending second ciphertext data and second digital signature data to the data demander, wherein the second ciphertext data and the second digital signature data are encrypted according to at least a second public key; and wherein the second public key is generated by the data demander.

[0013] Optionally, before the second ciphertext data and the second digital signature data are sent to the data demander, the method further comprises: encrypting result data according to the second public key to obtain the second ciphertext data, wherein the result data is generated by processing the trusted decrypted data in the trusted computing environment, the trusted decrypted data is obtained by decrypting the first ciphertext data; and the second initial encrypted data is obtained by encrypting the second ciphertext data according to the trusted private key, and the second digital signature data is obtained by encrypting the second initial encrypted data according to the second public key.

[0014] Optionally, before the result data is encrypted according to the second public key to obtain the second ciphertext data, the method further comprises: receiving the second public key from the data demander.

[0015] Optionally, encrypting the result data according to the second public key to obtain the second ciphertext data comprises: encrypting the result data according to the second public key and the asymmetric encryption algorithm SM2.

[0016] Optionally, the second initial encrypted data is obtained by encrypting the second ciphertext data according to the trusted private key, and the second digital signature data is obtained by encrypting the second initial encrypted data according to the second public key, which comprises: obtaining the second initial ciphertext by encrypting the second ciphertext data according to the hash algorithm SM3, the trusted private key and the asymmetric encryption algorithm SM2; and obtaining the second digital signature data by encrypting the second initial ciphertext according to the second public key and the asymmetric encryption algorithm SM2.

[0017] To achieve the above object, an embodiment of the present application provides a data transmission method, comprising the following steps: sending first ciphertext data and first digital signature data to the data transaction terminal, wherein the first ciphertext data and the first digital signature data are encrypted according to at least a trusted public key; and wherein the trusted public key is received from the data transaction terminal, and a trusted public-private key pair containing the trusted public key is generated by the data transaction terminal in a trusted computing environment.

[0018] Optionally, before sending the first ciphertext data and the first digital signature data to the data transaction terminal, the method further comprises: encrypting the original data by using the trusted public key to obtain the first ciphertext data; first encrypting the first ciphertext data by using the first private key to obtain first initial encrypted data, and then encrypting the first initial encrypted data by using the trusted public key to obtain the first digital signature data; wherein the first private key is generated by the data provider.

[0019] Optionally, encrypting the original data by using the trusted public key comprises: encrypting the original data by using the trusted public key and an asymmetric encryption algorithm SM2.

[0020] Optionally, first encrypting the first ciphertext data by using the first private key to obtain first initial encrypted data, and then encrypting the first initial encrypted data by using the trusted public key to obtain the first digital signature data comprises: first encrypting the first ciphertext data by using a hash algorithm SM3, the first private key and an asymmetric encryption algorithm SM2 to obtain first initial ciphertext; and then encrypting the first initial ciphertext by using the trusted public key and an asymmetric encryption algorithm SM2 to obtain the first digital signature data.

[0021] Optionally, the data transmission method further comprises: generating a first public-private key pair comprising a first public key and the first private key; and sending the first public key to the data transaction terminal.

[0022] To achieve the above object, an embodiment of the present application provides a data transmission method, comprising the following steps: receiving second ciphertext data and second digital signature data from a data transaction terminal, wherein the second ciphertext data and the second digital signature data are encrypted according to at least a second public key; verifying the second digital signature data; if the verification is passed, decrypting the second ciphertext data; wherein the second digital signature data is verified according to at least a second private key, and the second ciphertext data is decrypted.

[0023] Optionally, before receiving the second ciphertext data and the second digital signature data from the data transaction terminal, the method further comprises: generating a second public-private key pair comprising the second public key and the second private key, and sending the second public key to the data transaction terminal.

[0024] Optionally, verifying the second digital signature data according to at least the second private key comprises: performing a hash operation on the second ciphertext data by using a hash algorithm SM3 to obtain a second hash value; first decrypting the second digital signature data by using a trusted public key to obtain second initial decryption data, and then performing secondary decryption on the second initial decryption data by using the second private key to obtain second decryption data; comparing whether the second hash value and the second decryption data are completely same; if they are completely same, the verification is passed; wherein a trusted public-private key pair containing the trusted public key is generated by the data transaction terminal in a trusted computing environment.

[0025] Optionally, the first decrypting the second digital signature data by using a trusted public key to obtain second initial decryption data, and then performing secondary decryption on the second initial decryption data by using the second private key to obtain second decryption data comprises: first decrypting the second digital signature data by using the trusted public key and an asymmetric encryption algorithm SM2 to obtain second initial decryption data; and then decrypting the second initial decryption data by using the second private key and the asymmetric encryption algorithm SM2 to obtain the second decryption data.

[0026] Optionally, before the decrypting the second digital signature data by using the trusted public key and the asymmetric encryption algorithm SM2, the method further comprises: receiving the trusted public key from the data transaction terminal.

[0027] Optionally, the decrypting the second ciphertext data according to at least the second private key comprises: decrypting the second ciphertext data by using the second private key and the asymmetric encryption algorithm SM2.

[0028] The embodiment of the present application further provides a data transmission device, comprising: a first data receiving module, used for receiving first ciphertext data and first digital signature data from a data provider, wherein the first ciphertext data and the first digital signature data are encrypted according to at least a trusted public key; a first verification module, used for verifying the first digital signature data; a first decryption module, used for decrypting the first ciphertext data when the verification is passed, wherein verifying the first digital signature data according to at least a trusted private key and decrypting the first ciphertext data, a trusted public-private key pair containing the trusted public key is generated by a data transaction terminal in a trusted computing environment, and then the trusted public key is sent to the data provider; and a trusted public-private key pair generating module, used for generating a trusted public-private key pair by a data transaction terminal in a trusted computing environment, and then sending the trusted public key to the data provider.

[0029] The embodiment of the present application also provides a data transmission device, comprising: a first data sending module, used for sending first cipher-text data and first digital signature data to a data transaction terminal, wherein the first cipher-text data and the first digital signature data are encrypted according to at least a trusted public key, wherein the trusted public key is received from the data transaction terminal, and a trusted public-private key pair containing the trusted public key is generated by the data transaction terminal in a trusted computing environment; a first public-private key pair generating module, used for generating a first public-private key pair by a data provider and sending a first public key to the data transaction terminal.

[0030] The embodiment of the present application also provides a data transmission device, comprising: a second data receiving module, used for receiving second cipher-text data and second digital signature data from a data transaction terminal, wherein the second cipher-text data and the second digital signature data are encrypted according to at least a second public key; a second verifying module, used for verifying the second digital signature data; a second decryption module, used for decrypting the second cipher-text data when the verification is passed, wherein the second digital signature data is verified according to at least a second private key and the second cipher-text data is decrypted; and a second public-private key pair generating module, used for generating a second public-private key pair by a data requester and sending the second public key to the data transaction terminal.

[0031] The embodiment of the present application also provides a computer readable storage medium, which stores computer instructions, and the computer instructions perform the steps of the data transmission method when running.

[0032] The embodiment of the present application also provides a data transaction terminal, comprising a memory and a processor, wherein the memory stores computer instructions capable of running on the processor, and the processor performs the steps of the data transmission method when running the computer instructions.

[0033] The embodiment of the present application also provides a data provider, comprising a memory and a processor, wherein the memory stores computer instructions capable of running on the processor, and the processor performs the steps of the data transmission method when running the computer instructions.

[0034] The embodiment of the present application also provides a data requester, comprising a memory and a processor, wherein the memory stores computer instructions capable of running on the processor, and the processor performs the steps of the data transmission method when running the computer instructions.

[0035] Compared with the prior art, the technical scheme of the embodiment of the present application has the following beneficial effects:

[0036] In the embodiment of the present application, the first ciphertext data and the first digital signature data are received from the data provider, wherein the first ciphertext data and the first digital signature data are encrypted according to at least a trusted public key; the first digital signature data is verified; if the verification is passed, the first ciphertext data is decrypted; wherein the first digital signature data is verified according to at least a trusted private key and the first ciphertext data is decrypted. The trusted public-private key pair containing the trusted public key is generated by the data transaction terminal in a trusted computing environment, and then the trusted public key is sent to the data provider. Compared with the prior art which only transmits data in a simple and direct terminal-to-terminal manner, the original data provided by the data provider and the result data obtained after the data is calculated or modeled by the data demander are easily leaked, stolen, tampered with and the like in the transmission process, so that the security of data transmission cannot be guaranteed. In the embodiment of the present application, a trusted public-private key pair is used in the data transmission process from the data provider to the data demander, and at least the original plaintext data is encrypted and digitally signed according to the trusted public key, and then verified and decrypted according to at least the trusted private key, so that the security of data transmission is effectively improved. In the embodiment of the present application, a trusted computing environment is provided. Since the trusted computing environment is a fully closed operation area, the data demander can safely and controllably process the data in the environment, so that the data is not leaked or tampered with.

[0037] Further, before sending the data to the data transaction terminal, the data provider first encrypts the original data according to the trusted public key generated by the data transaction terminal in the trusted computing environment and the asymmetric encryption algorithm SM2 to obtain the first ciphertext data, and then encrypts the first ciphertext data according to the hash algorithm SM3, the first private key generated by the data provider and the asymmetric encryption algorithm SM2 to obtain the first initial ciphertext; and then encrypts the first initial ciphertext twice according to the trusted public key and the asymmetric encryption algorithm SM2 to obtain the first digital signature data. After receiving the first ciphertext data and the first digital signature data, the data transaction terminal verifies the signature according to the same algorithms and the first public key generated by the data provider and the trusted private key generated by the data transaction terminal in the trusted computing environment, and then decrypts the first ciphertext data according to the trusted private key after determining that the verification is passed. The identity of the data provider can be verified to ensure that the received data is sent by the specified data provider, and the data is prevented from being tampered with in the transmission process, so that the integrity of the data is guaranteed, and the security and reliability of data transmission are improved.

[0038] Further, only after the verification of the received first digital signature data is passed, that is, after confirming that the received data comes from the specified data provider and confirming that the data is not tampered or forged during transmission, the received first ciphertext data is decrypted. Otherwise, if the verification of the received first digital signature data is not passed, the decryption step does not need to be performed, which can reduce the operation overhead and protect the integrity of the data and the authenticity and reliability of the data source. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 is a flowchart of a first data transmission method in an embodiment of the present application;

[0040] Figure 2 is a partial flowchart of a second data transmission method in an embodiment of the present application;

[0041] Figure 3 is a flowchart of a third data transmission method in an embodiment of the present application;

[0042] Figure 4 is a data flowchart of a fourth data transmission method in an embodiment of the present application;

[0043] Figure 5 is a structural schematic diagram of a first data transmission device in an embodiment of the present application;

[0044] Figure 6 is a structural schematic diagram of a second data transmission device in an embodiment of the present application;

[0045] Figure 7 is a structural schematic diagram of a third data transmission device in an embodiment of the present application. DETAILED DESCRIPTION

[0046] As described above, in the big data era, data is increasingly becoming an asset that can be traded, and the data demand side obtains the required result data by calculating or modeling the original data by purchasing the data use right of the data provider. In order to maximize the interests of both parties in data transaction, it is necessary to provide a secure, controllable and trusted computing environment for the data demand side to calculate or model the data to protect the data from being leaked or tampered, and to ensure the secure transmission of the original data and the result data between the data provider and the data demand side.

[0047] In the prior art, data transmission between mobile terminals is usually carried out in a point-to-point manner, that is, the first terminal directly transmits data to the second terminal. For example, in data transaction, the data provider directly transmits the original data to the data demand side, and the data demand side performs modeling analysis on its own platform to obtain the result data after obtaining the original data, achieving the use purpose.

[0048] The inventor of the present application has found through research that the security of data transmission cannot be guaranteed without any safe and reliable encryption technology, because the original data provided by the data provider and the result data obtained after calculation or modeling by the data consumer can be easily leaked, stolen, tampered with, etc. during transmission, damaging the interests of both parties to the data transaction. In addition, if a trusted computing environment is not provided, the restrictions on the data consumer cannot be effectively reached during the process of modeling and analyzing the original data obtained by the data consumer, so the data consumer cannot be prevented from intentionally or unintentionally leaking, misusing or processing the data, resulting in extremely low security and controllability of the data.

[0049] To solve the above problems, in the embodiments of the present application, first ciphertext data and first digital signature data are received from a data provider, wherein the first ciphertext data and the first digital signature data are encrypted according to at least a trusted public key; the first digital signature data is verified; if the verification is passed, the first ciphertext data is decrypted; wherein the first digital signature data is verified according to at least a trusted private key and the first ciphertext data is decrypted. The trusted public-private key pair containing the trusted public key is generated by a data transaction terminal in a trusted computing environment, and then the trusted public key is sent to the data provider. Compared with the prior art, which only transmits data in a simple and direct terminal-to-terminal manner, the original data provided by the data provider and the result data obtained after calculation or modeling by the data consumer can be easily leaked, stolen, tampered with, etc. during transmission, resulting in the security of data transmission cannot be guaranteed. In the embodiments of the present application, a trusted public-private key pair is used in the data transmission process from the data provider to the data consumer, and the original plaintext data can be encrypted and digitally signed according to at least a trusted public key, and then verified and decrypted according to at least a trusted private key, effectively improving the security of data transmission. In the embodiments of the present application, a trusted computing environment is provided, and since the trusted computing environment is a fully enclosed operating area, the data consumer can safely and controllably process the data in the environment, ensuring that the data is not leaked or tampered with.

[0050] To make the above-mentioned purposes, features and benefits of the present application more obvious and easy to understand, specific embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0051] Reference Figure 1 , Figure 1 is a flowchart of the first data transmission method in the embodiments of the present application. The first data transmission method can be used in a data transaction terminal and can include steps S11 to S13:

[0052] Step S11: receiving first cipher data and first digital signature data from a data provider, wherein the first cipher data and the first digital signature data are encrypted according to at least a trusted public key;

[0053] Step S12: verifying the first digital signature data;

[0054] Step S13: decrypting the first cipher data after determining that the verification is passed.

[0055] Wherein, the first digital signature data is verified according to at least a trusted private key, and the first cipher data is decrypted; a trusted public-private key pair containing the trusted public key is generated by a data transaction terminal in a trusted computing environment, and then the trusted public key is sent to the data provider.

[0056] In the implementation of step S11, the first cipher data is obtained by encrypting original data using the trusted public key; the first digital signature data is obtained by encrypting the first cipher data using a first private key to obtain first initial encrypted data, and then encrypting the first initial encrypted data using the trusted public key.

[0057] Wherein, the first private key is generated by the data provider, and the first public key corresponding to the first private key is generated by the data provider, wherein the first private key is kept secret by the data provider, and the first public key is publicly disclosed and sent to the data transaction terminal.

[0058] Wherein, the trusted public key is used to indicate a key generated by the data transaction terminal in a trusted computing environment, and the trusted private key corresponding to the trusted public key is generated by the data transaction terminal in a trusted computing environment, wherein the trusted private key is kept secret by the data transaction terminal, and the trusted public key is publicly disclosed and sent to the data provider. When a trusted public-private key pair is used, if one of the keys is used to encrypt a piece of data, the other key must be used to decrypt it. For example, if the data is encrypted using the trusted public key, the corresponding trusted private key must be used to successfully decrypt it; if the data is encrypted using the trusted private key, the corresponding trusted public key must be used to successfully decrypt it.

[0059] It should be particularly noted that the first private key is different from the trusted private key, and the first public key is different from the trusted public key. The first public-private key pair and the trusted public-private key pair are two independent key pairs generated by the data provider and the data transaction terminal, respectively.

[0060] It should be noted that in the specific implementation, for the data provider, it is not necessary to generate a first public-private key pair before each round of data transmission and send the first public key to the data transaction terminal; similarly, for the data transaction terminal, it is also not necessary to generate a trusted public-private key pair before each round of data transmission and send the trusted public key to the data provider. It can be sent only before the first round of data transmission or after the public-private key pair is updated.

[0061] The trusted computing environment can be a fully enclosed operation area, so that the data consumer can safely and controllably process the data in the environment, and the data is not leaked or tampered.

[0062] The original data is used to indicate the plaintext data provided by the data provider initially, which is usually unencrypted for use by the data consumer; the first ciphertext data is used to indicate the data generated by the data provider after encrypting the original data; and the first digital signature data is used to indicate the data generated by the data provider after processing by a digital signature technology, wherein the digital signature is a method of signing a message in electronic form, a signed message can be transmitted in a communication network, and the digital signature can be obtained based on a public key cryptography system and a private key cryptography system. This technology can be used for data confirmation (data authentication) and data integrity (judgment of whether the data is tampered or forged).

[0063] In the specific implementation of step S12, the verification of the first digital signature data according to the trusted private key includes: performing a hash operation on the first ciphertext data by using a hash algorithm SM3 to obtain a first hash value; first decrypting the first digital signature data by using a first public key to obtain first initial decryption data, and then performing a second decryption on the first initial decryption data by using the trusted private key to obtain first decryption data; comparing whether the first hash value and the first decryption data are completely same; if they are completely same, the verification is passed; wherein the first public key is generated by the data provider.

[0064] Further, the first decryption of the first digital signature data by using the first public key to obtain first initial decryption data, and the second decryption of the first initial decryption data by using the trusted private key to obtain first decryption data include: first decrypting the first digital signature data by using the first public key and an asymmetric encryption algorithm SM2 to obtain the first initial decryption data; and then decrypting the first initial decryption data by using the trusted private key and the asymmetric encryption algorithm SM2 to obtain the first decryption data.

[0065] The hash algorithm SM3 is a kind of cryptographic hash function standard, in a commercial cryptographic system, SM3 is mainly used for digital signature and verification, message authentication code generation and verification, random number generation, etc., and its algorithm is open to the public; the asymmetric encryption algorithm SM2 is a kind of encryption algorithm with different encryption key and decryption key, also known as public key algorithm (Public Key Cryptography), the algorithm has a pair of public and private key pair for encryption and decryption.

[0066] In a specific embodiment of the embodiment of the application, the following formula can be used to verify the first digital signature data:

[0067] (1) the hash algorithm SM3 is used to perform hash operation on the first ciphertext data to obtain a first hash value:

[0068] reciveHashCode1=sm3(enData1);

[0069] Wherein, reciveHashCode1 is used to represent the first hash value; enData1 is used to represent the first ciphertext data; sm3() is used to represent the hash algorithm SM3.

[0070] (2) the first digital signature data is decrypted by using the following method:

[0071] sendHashCode1=sm2.decrypt(sm2.decrypt(sign1,senderPublicKey),safePrivat eKey));

[0072] Wherein, sendHashCode1 is used to represent the first decrypted data; sm2.decrypt() is used to represent the asymmetric encryption algorithm SM2; sign1 is used to represent the first digital signature data; senderPublicKey is used to represent the public key of the data supplier; safePrivateKey is used to represent the trusted private key.

[0073] (3) whether reciveHashCode1 is equal to sendHashCode1 is compared:

[0074] If they are equal, the verification is passed. It is proved that the data transmitted this time has not been tampered with, and it is sent by the specified data sender, and the identity of the data sender is confirmed. Otherwise, the data is tampered with or sent by a non-specified data sender.

[0075] In the embodiment of the present application, by verifying the first digital signature data received from the data provider, it can be confirmed that the received data is from the specified data provider and that the data is not tampered or forged in the transmission process, thereby ensuring the authenticity and reliability of the data source and improving the security of data transmission. Specifically, after confirming that the received data is from the specified data provider and that the data is not tampered or forged in the transmission process, the received first ciphertext data is decrypted, otherwise, if the received first digital signature data is not verified, the decryption step is not required, and the operation overhead can be reduced.

[0076] In the embodiment of the present application, after receiving the first ciphertext data and the first digital signature data, the data transaction terminal verifies the signature by using the first public key generated by the data provider and the trusted private key generated by the data transaction terminal in the trusted computing environment, and then decrypts the first ciphertext data by using the trusted private key after the verification is passed. The identity of the data provider can be verified to ensure that the received data is sent by the specified data provider, and the data is prevented from being tampered in the transmission process, thereby ensuring the integrity of the data and improving the security and reliability of data transmission.

[0077] Further, before the first digital signature data is decrypted by using the first public key, the method further comprises receiving the first public key from the data provider.

[0078] In the specific implementation of step S13, after the verification is passed, the first ciphertext data is decrypted.

[0079] Further, the first ciphertext data is decrypted by using the trusted private key and the asymmetric encryption algorithm SM2.

[0080] In one specific implementation of the embodiment of the present application, the first ciphertext data can be decrypted by using the following formula:

[0081] safedata=sm2.decrypt(enData1,safePrivateKey);

[0082] Wherein, safedata is used to indicate the trusted decrypted data obtained by decrypting the first ciphertext data; sm2.decrypt() is used to indicate the asymmetric encryption algorithm SM2; enData1 is used to indicate the first ciphertext data; and safePrivateKey is used to indicate the trusted private key.

[0083] It can be understood that only after the verification of the received first digital signature data is passed, that is, after confirming that the received data comes from the designated data provider and confirming that the data is not tampered or forged during transmission, the received first ciphertext data is decrypted. Otherwise, if the verification of the received first digital signature data is not passed, the decryption step does not need to be performed, the operation cost can be reduced, and the authenticity and reliability of the data source and the integrity of the data are guaranteed.

[0084] Further, after the first ciphertext data is decrypted, the method further comprises: sending second ciphertext data and second digital signature data to the data demander.

[0085] Among them, the second ciphertext data and the second digital signature data are encrypted according to at least a second public key.

[0086] Among them, the second public key is generated by the data demander, and the corresponding second private key is generated by the data demander, wherein the second private key is kept secret by the data demander, and the second public key is disclosed to the outside and sent to the data transaction terminal.

[0087] It should be particularly pointed out that the second public key is different from the trusted public key, and the second private key is also different from the trusted private key. The second public-private key pair and the trusted public-private key pair are two independent key pairs generated by the data demander and the data transaction terminal, respectively.

[0088] Further, before sending the second ciphertext data and the second digital signature data to the data demander, the method further comprises: encrypting the result data using the second public key to obtain the second ciphertext data, wherein the result data is generated after processing the trusted decryption data in the trusted computing environment, and the trusted decryption data is obtained by decrypting the first ciphertext data; the second ciphertext data is first encrypted using the trusted private key to obtain second initial encrypted data, and then the second initial encrypted data is encrypted using the second public key to obtain the second digital signature data.

[0089] It should be pointed out that the trusted decryption data is used to indicate the data obtained by decrypting the first ciphertext data using the trusted private key generated in the trusted computing environment, and the data demander can directly or remotely access the trusted computing environment running on the data transaction terminal, and then calculate or model analyze the trusted decryption data in the trusted computing environment to obtain the result data.

[0090] Further, before the result data is encrypted by using the second public key to obtain the second ciphertext data, the method further comprises: receiving the second public key from the data demander.

[0091] Further, the encrypting the result data by using the second public key to obtain the second ciphertext data comprises: encrypting the result data by using the second public key and an asymmetric encryption algorithm SM2.

[0092] In one specific implementation of the embodiments of the present application, the result data can be encrypted to obtain the second ciphertext data by using the following formula:

[0093] enData2=sm2.encryption(resultData,reciverPublicKey);

[0094] Wherein, enData2 is used to represent the second ciphertext data obtained after encryption; sm2.encryption() is used to represent the asymmetric encryption algorithm SM2; resultData is used to represent the result data; and reciverPublicKey is used to represent the second public key.

[0095] Further, the encrypting the second ciphertext data by using the trusted private key to obtain the second initial encrypted data, and then encrypting the second initial encrypted data by using the second public key to obtain the second digital signature data comprises: encrypting the second ciphertext data by using a hash algorithm SM3, the trusted private key and the asymmetric encryption algorithm SM2 to obtain second initial ciphertext; and encrypting the second initial ciphertext by using the second public key and the asymmetric encryption algorithm SM2 to obtain the second digital signature data.

[0096] In one specific implementation of the embodiments of the present application, the above-mentioned two steps of digital signature can be completed by using the following formula:

[0097] Sign2=sm2.encryption(sm2.encryption(sm3(enData2),safePrivateKey),reciver PublicKey);

[0098] Wherein, Sign2 is used to represent the second digital signature data; sm2.encryption(xxx) is used to represent the asymmetric encryption algorithm SM2; sm3() is used to represent the hash algorithm SM3; enData2 is used to represent the second ciphertext data; safePrivateKey is used to represent the trusted private key generated by the data transaction terminal in the trusted computing environment; and reciverPublicKey is used to represent the second public key generated by the data demander.

[0099] Referring to Figure 2 , Figure 2 is a flowchart of a second data transmission method in the embodiments of the present application, and the second data transmission method can be used for a data provider and can include steps S21 to S24, which are described below.

[0100] In step S21, the original data is encrypted by using a trusted public key and an asymmetric encryption algorithm SM2 to obtain first ciphertext data.

[0101] The trusted public key is received from the data transaction terminal, and a trusted public-private key pair containing the trusted public key is generated by the data transaction terminal in a trusted computing environment.

[0102] It should be noted that, in a specific implementation, the data provider does not need to receive the trusted public key from the data transaction terminal before each round of data transmission, but can receive the trusted public key only before the first round of data transmission or after the data transaction terminal updates the trusted public-private key pair.

[0103] In a specific implementation of the embodiments of the present application, the following formula can be used to encrypt the original data to obtain the first ciphertext data:

[0104] enData1=sm2.encryption(originData,safePublicKey);

[0105] wherein enData1 is used to represent the first ciphertext data obtained after encryption; sm2.encryption() is used to represent the asymmetric encryption algorithm SM2; originData is used to represent the original data; and safePublicKey is used to represent the trusted public key.

[0106] In the embodiment of the present application, before sending data to the data transaction terminal, the data provider first encrypts the original data by using the trusted public key generated in the trusted computing environment by the data transaction terminal and the asymmetric encryption algorithm SM2 to obtain first ciphertext data, and then encrypts the first ciphertext data by using the hash algorithm SM3, the first private key generated by the data provider and the asymmetric encryption algorithm SM2 to obtain first initial ciphertext; and then encrypts the first initial ciphertext by using the trusted public key and the asymmetric encryption algorithm SM2 to obtain first digital signature data. Compared with the case that the data provider directly sends the original plaintext data without using any encryption method or the case that the data provider sends the original plaintext data to the data transaction terminal after encrypting the original plaintext data by using the private key of the data provider and the data transaction terminal decrypts the original plaintext data by using the public key of the data provider, the embodiment of the present application uses the trusted public and private keys generated in the trusted computing environment to encrypt and decrypt, which can ensure that the ciphertext data sent by the data provider can only be successfully decrypted in the trusted computing environment, thereby improving the security of data transmission and ensuring the security and controllability of subsequent data calculation or modeling.

[0107] In step S22, the first ciphertext data is encrypted by using the hash algorithm SM3, the first private key and the asymmetric encryption algorithm SM2 to obtain first initial ciphertext.

[0108] The first private key is generated by the data provider.

[0109] In step S23, the first initial ciphertext is encrypted again by using the trusted public key and the asymmetric encryption algorithm SM2 to obtain first digital signature data.

[0110] In one specific implementation of the embodiment of the present application, the following formula can be used to complete the above two steps of digital signature:

[0111] Sign1=sm2.encryption(sm2.encryption(sm3(enData1),senderPrivateKey),safe PublicKey);

[0112] Sign1 represents the first digital signature data; sm2.encryption() represents the asymmetric encryption algorithm SM2; sm3() represents the hash algorithm SM3; enData1 represents the first ciphertext data; senderPrivateKey represents the first private key generated by the data provider; and safePublicKey represents the trusted public key generated in the trusted computing environment by the data transaction terminal.

[0113] In step S24, the first cipher data and the first digital signature data are sent to the data transaction terminal.

[0114] It can be understood that, in the embodiment of the present application, the data provider encrypts and digitally signs the original data to obtain the first cipher data and the first digital signature data according to the trusted public key received from the data transaction terminal. Since the trusted public key has a unique correspondence with the trusted private key, and the trusted private key can only be kept secret by the data transaction terminal itself, after receiving the first cipher data and the first digital signature data sent by the data provider, the data transaction terminal should at least verify the signature and decrypt according to the corresponding unique trusted private key, thereby ensuring the authenticity and reliability of the data source and the security of the transmission.

[0115] In specific implementation, more details of steps S21 to S24 can be implemented by referring to the step descriptions in the foregoing and Figure 1 .

[0116] Refer to Figure 3 , Figure 3 is a flowchart of a third data transmission method in the embodiment of the present application, which can be used for a data receiver and can include steps S31 to S33, which are described as follows.

[0117] In step S31, second cipher data and second digital signature data are received from the data transaction terminal, wherein the second cipher data and the second digital signature data are obtained by encrypting at least according to a second public key.

[0118] In step S32, the second digital signature data is verified.

[0119] In step S33, after determining that the verification is passed, the second cipher data is decrypted.

[0120] Wherein, the second digital signature data is verified and the second cipher data is decrypted at least according to a second private key.

[0121] It should be noted that the second cipher data is obtained by processing the first cipher data of the data provider by the data transaction terminal using a trusted private key and a second public key, and the second digital signature data is obtained by digitally signing the second cipher data by the data transaction terminal using the second public key.

[0122] Wherein, the trusted public key is used to indicate a key generated by the data transaction terminal in a trusted computing environment, and the corresponding trusted private key is generated by the data transaction terminal in the trusted computing environment. More details about the trusted computing environment can be found in the foregoing andFigure 1 The technical solutions shown here will not be described again.

[0123] Further, the second ciphertext data is obtained by the data transaction terminal decrypting the first ciphertext data of the data provider using a trusted private key to obtain trusted decryption data, and then encrypting the result data obtained by processing the trusted decryption data in a trusted computing environment using a second public key.

[0124] Further, before receiving the second ciphertext data and the second digital signature data from the data transaction terminal, the method further comprises: generating a second public-private key pair comprising the second public key and the second private key, and sending the second public key to the data transaction terminal.

[0125] It should be noted that in specific implementation, for the data receiver, it is not necessary to generate a second public-private key pair and send the second public key to the data transaction terminal before each round of data transmission.

[0126] Further, verifying the second digital signature data according to at least the second private key comprises: performing a hash operation on the second ciphertext data using a hash algorithm SM3 to obtain a second hash value; first decrypting the second digital signature data using a trusted public key to obtain second initial decryption data, and then performing a second decryption on the second initial decryption data using the second private key to obtain second decryption data; comparing whether the second hash value and the second decryption data are completely identical; and if they are completely identical, the verification is passed.

[0127] Further, the first decryption of the second digital signature data using the trusted public key to obtain second initial decryption data, and the second decryption of the second initial decryption data using the second private key to obtain second decryption data comprise: first decrypting the second digital signature data using the trusted public key and an asymmetric encryption algorithm SM2 to obtain second initial decryption data; and then decrypting the second initial decryption data using the second private key and the asymmetric encryption algorithm SM2 to obtain the second decryption data.

[0128] In one specific implementation of the embodiment of the application, the following formula can be used to verify the second digital signature data:

[0129] (1) Perform a hash operation on the second ciphertext data using a hash algorithm SM3 to obtain a second hash value:

[0130] reciveHashCode2=sm3(enData2);

[0131] Wherein, reciveHashCode2 is used for indicating the second hash value; enData2 is used for indicating the second cipher data; sm3(xxx) is used for indicating the hash algorithm SM3.

[0132] (2) The second digital signature data is decrypted by using the following mode:

[0133] sendHashCode2 = sm2.decrypt (sm2.decrypt (sign2, safePublicKey), recieverPrivateKey) ;

[0134] PrivateKey) ;

[0135] Wherein, sendHashCode2 is used for indicating the second decrypted data; sm2.decrypt() is used for indicating the asymmetric encryption algorithm SM2; sign2 is used for indicating the second digital signature data; safePublicKey is used for indicating the trusted public key; recieverPrivateKey is used for indicating the second private key generated by the data receiver.

[0136] (3) Comparing whether reciveHashCode2 is equal to sendHashCode2:

[0137] If yes, the verification is passed. It indicates that the data in this transmission is not tampered and is sent by the specified data sender, and the identity of the data sender is confirmed. Otherwise, the data is tampered or is sent by the non-specified data sender.

[0138] In the embodiment of the present application, in the data transmission process from the data provider to the data receiver, the first public-private key pair generated by the data provider, the trusted public-private key pair generated by the data transaction terminal in the trusted computing environment and the second public-private key pair generated by the data receiver are used to encrypt and digitally sign the original plaintext data and the result data generated after calculation modeling, and then the digital signature is verified and decrypted. Compared with the prior art which only uses the simple and direct terminal-to-terminal mode for data transmission, the original data provided by the data provider and the result data obtained after calculation or modeling by the data receiver are easily leaked, stolen, tampered and the like in the transmission process, which leads to the security of data transmission cannot be guaranteed. The technical scheme of the embodiment of the present application can effectively improve the security and reliability of data transmission and guarantee the integrity of data in the transmission process.

[0139] In the embodiment of the present application, by verifying the second digital signature data received from the data transaction terminal, it can be confirmed whether the received data is from the data transaction terminal and whether the data is tampered or forged in the process of transmission, thereby ensuring the authenticity and reliability of the data source and improving the security of data transmission.

[0140] Further, before decrypting the second digital signature data by using the trusted public key and the asymmetric encryption algorithm SM2, the method further comprises: receiving the trusted public key from the data transaction terminal.

[0141] It should be noted that, for the data transaction terminal, it is also not necessary to generate a trusted public-private key pair once before each round of data transmission and send the trusted public key to the data demander. It can be sent only before the first round of data transmission or after the public-private key pair is updated.

[0142] Further, the at least decrypting the second ciphertext data according to the second private key comprises: decrypting the second ciphertext data by using the second private key and the asymmetric encryption algorithm SM2.

[0143] In a specific implementation of the embodiment of the present application, the following formula can be used to decrypt the second ciphertext data:

[0144] finalData = sm2.decrypt(enData2, recieverPrivateKey);

[0145] Wherein, finalData is used to indicate the final decrypted data obtained by decrypting the second ciphertext data; sm2.decrypt() is used to indicate the asymmetric encryption algorithm SM2; enData2 is used to indicate the second ciphertext data; recieverPrivateKey is used to indicate the second private key generated by the data demander.

[0146] Reference Figure 4 , Figure 4 is a data flow diagram of the fourth data transmission method in the embodiment of the present application. The data transmission method can include steps S401 to S410, which are described below.

[0147] In step S401, the data supplier 41 encrypts the original data by using the trusted public key to obtain the first ciphertext data.

[0148] In step S402, the data supplier 41 at least digitally signs the first ciphertext data by using the trusted public key to obtain the first digital signature data.

[0149] The trusted public key is received from the data transaction terminal.

[0150] In step S403, the data provider 41 sends the first cipher data and the first digital signature data to the data transaction terminal 42.

[0151] In step S404, the data transaction terminal 42 verifies the first digital signature data by using at least the trusted private key.

[0152] In step S405, the data transaction terminal 42 decrypts the first cipher data by using the trusted private key if the verification is passed.

[0153] In step S406, the data transaction terminal 42 encrypts the result data by using the second public key to obtain second cipher data.

[0154] The result data is generated by processing the trusted decrypted data in the trusted computing environment, and the trusted decrypted data is obtained by decrypting the first cipher data.

[0155] Further, before the result data is encrypted by using the second public key to obtain the second cipher data, the method further comprises receiving the second public key from the data requester.

[0156] In step S407, the data transaction terminal 42 digitally signs the second cipher data by using at least the second public key to obtain second digital signature data.

[0157] In step S408, the data transaction terminal 42 sends the second cipher data and the second digital signature data to the data requester 43.

[0158] In step S409, the data requester 43 verifies the second digital signature data by using at least the second private key.

[0159] In step S410, the data requester 43 decrypts the second cipher data by using the second private key if the verification is passed.

[0160] In specific implementation, more details of steps S401 to S410 can be performed by referring to the description of steps in Figures 1 to 3 , which will not be repeated here.

[0161] Refer to Figure 5 , Figure 5 is a structural schematic diagram of the first data transmission device in the embodiment of the application. The first data transmission device can be used in a data transaction terminal, and can include:

[0162] The first data receiving module 51 is configured to receive first cipher-text data and first digital signature data from a data provider, wherein the first cipher-text data and the first digital signature data are encrypted according to at least a trusted public key; the first verifying module 52 is configured to verify the first digital signature data; the first decrypting module 53 is configured to decrypt the first cipher-text data when the verification is passed, wherein the verification of the first digital signature data and the decryption of the first cipher-text data are both performed according to at least a trusted private key, and a trusted public-private key pair containing the trusted public key is generated by a data transaction terminal in a trusted computing environment and then sent to the data provider; and the trusted public-private key pair generating module 54 is configured to generate a trusted public-private key pair by the data transaction terminal in the trusted computing environment and then send the trusted public key to the data provider.

[0163] For the principle, specific implementation and beneficial effects of the data transmission device, please refer to the foregoing description and Figure 1 and Figure 4 The related description of the data transmission method is shown, and will not be repeated here.

[0164] For the principle, specific implementation and beneficial effects of the data transmission device, please refer to the foregoing description and Figure 6 , Figure 6 is a structural schematic diagram of a second data transmission device in the embodiment of the application. The second data transmission device can be used for a data provider and can include: a first data sending module 61 configured to send first cipher-text data and first digital signature data to a data transaction terminal, wherein the first cipher-text data and the first digital signature data are encrypted according to at least a trusted public key, wherein the trusted public key is received from the data transaction terminal, and a trusted public-private key pair containing the trusted public key is generated by the data transaction terminal in a trusted computing environment; and a first public-private key pair generating module 62 configured to generate a first public-private key pair by the data provider and send a first public key to the data transaction terminal.

[0165] For the principle, specific implementation and beneficial effects of the data transmission device, please refer to the foregoing description and Figure 2 and Figure 4 The related description of the data transmission method is shown, and will not be repeated here.

[0166] For the principle, specific implementation and beneficial effects of the data transmission device, please refer to the foregoing description and Figure 7 , Figure 7This is a schematic diagram of the structure of a third type of data transmission device in an embodiment of the present invention. The third type of data transmission device can be used by a data demander and may include: a second data receiving module 71, used to receive second encrypted data and second digital signature data from a data transaction terminal, wherein the second encrypted data and second digital signature data are encrypted at least using a second public key; a second verification module 72, used to verify the second digital signature data; a second decryption module 73, used to decrypt the second encrypted data when verification is successful, wherein the second digital signature data is verified and the second encrypted data is decrypted at least using a second private key; and a second public-private key pair generation module 74, used by the data demander to generate a second public-private key pair and send the second public key to the data transaction terminal.

[0167] For the principles, specific implementation, and beneficial effects of the aforementioned data transmission device, please refer to the preceding text. Figure 3 and Figure 4 The descriptions of the data transmission methods shown are not repeated here.

[0168] This invention also provides a computer-readable storage medium storing computer instructions, which, when executed, perform the steps of the data transmission method described above. The computer-readable storage medium may include non-volatile or non-transitory memory, and may also include optical discs, hard disk drives, solid-state drives, etc.

[0169] Specifically, in this embodiment of the invention, the processor can be a central processing unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0170] It should also be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM) or flash memory. The volatile memory can be random access memory (RAM) used as an external cache. By way of example, but not by way of limitation, many forms of random access memory (RAM) are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchlink dynamic random access memory (SLDRAM) and direct rambus random access memory (DR RAM).

[0171] The embodiments of the present application also provide a data transaction terminal, including a memory and a processor, the memory stores computer instructions capable of running on the processor, and the processor executes the steps of the above data transmission method when running the computer instructions. The data transaction terminal can include but is not limited to mobile phones, computers, tablet computers and other terminal devices, and can also be servers, cloud platforms and the like.

[0172] The embodiments of the present application also provide a data supplier, including a memory and a processor, the memory stores computer instructions capable of running on the processor, and the processor executes the steps of the above data transmission method when running the computer instructions. The data supplier can include but is not limited to mobile phones, computers, tablet computers and other terminal devices, and can also be servers, cloud platforms and the like.

[0173] The embodiment of the present application further provides a data demander, comprising a memory and a processor, wherein the memory stores computer instructions capable of running on the processor, and the processor executes steps of the data transmission method when running the computer instructions. The data demander can comprise, but is not limited to, a terminal device such as a mobile phone, a computer, a tablet computer and the like, and can also be a server, a cloud platform and the like.

[0174] It should be understood that the term "and / or" herein only describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can represent three cases of existence of A alone, existence of A and B simultaneously and existence of B alone. In addition, the character " / " herein represents an "or" relationship between the associated objects before and after the character " / ".

[0175] The "multiple" appearing in the embodiments of the present application refers to two or more than two.

[0176] The first, second and the like appearing in the embodiments of the present application are only used for description and distinction of the description objects, and there is no order difference, nor represent a special limitation of the number of devices in the embodiments of the present application, which cannot constitute any limitation on the embodiments of the present application.

[0177] It should be pointed out that the serial numbers of the steps in the embodiments do not represent the limitation of the execution order of the steps.

[0178] Although the present application is disclosed as above, the present application is not limited thereto. Any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present application, and therefore the protection scope of the present application should be subject to the range defined by the claims.

Claims

1. A data transmission method, characterized by, The data provider encrypts original data by using a trusted public key to obtain first ciphertext data, encrypts the first ciphertext data by using a first private key to obtain first initial encrypted data, and encrypts the first initial encrypted data by using the trusted public key to obtain first digital signature data, and sends the first ciphertext data and the first digital signature data to a data transaction terminal, wherein the trusted public key is received from the data transaction terminal, and a trusted public-private key pair containing the trusted public key is generated by the data transaction terminal in a trusted computing environment. The data transaction terminal receives the first ciphertext data and the first digital signature data from the data provider, the first ciphertext data is obtained by encrypting original data by using the trusted public key, the first digital signature data is obtained by encrypting the first ciphertext data by using the first private key to obtain first initial encrypted data and then encrypting the first initial encrypted data by using the trusted public key, and the first private key is generated by the data provider. The data transaction terminal verifies the first digital signature data, and if the verification is passed, decrypts the first ciphertext data, wherein the first digital signature data is verified and the first ciphertext data is decrypted according to at least a trusted private key, and after the first ciphertext data is decrypted, second ciphertext data and second digital signature data are sent to a data requester, wherein the second ciphertext data and the second digital signature data are encrypted according to at least a second public key, and the second public key is generated by the data requester. The data requester receives the second ciphertext data and the second digital signature data from the data transaction terminal, wherein the second ciphertext data and the second digital signature data are encrypted according to at least a second public key, verifies the second digital signature data, and if the verification is passed, decrypts the second ciphertext data, wherein the second digital signature data is verified and the second ciphertext data is decrypted according to at least a second private key. The verification of the first digital signature data according to at least a trusted private key comprises:

2. The method of claim 1, wherein, The data transaction terminal performs a hash operation on the first ciphertext data by using a hash algorithm SM3 to obtain a first hash value; The first digital signature data is decrypted by using a first public key to obtain first initial decrypted data, and the first initial decrypted data is decrypted by using the trusted private key to obtain first decrypted data; The first hash value is compared with the first decrypted data to determine whether they are completely same; If they are completely same, the verification is passed; The first public key is generated by the data provider. The decryption of the first digital signature data by using a first public key to obtain first initial decrypted data, and the second decryption of the first initial decrypted data by using the trusted private key to obtain first decrypted data comprises:

3. The method of claim 2, wherein, ​ The data transaction terminal first decrypts the first digital signature data by using the first public key and an asymmetric encryption algorithm SM2 to obtain first initial decryption data; Then the data transaction terminal decrypts the first initial decryption data by using the trusted private key and the asymmetric encryption algorithm SM2 to obtain the first decryption data.

4. The method according to claim 2 or 3, characterized in that, Before decrypting the first digital signature data by using the first public key, the method further comprises: The data transaction terminal receives the first public key from the data provider.

5. The method of claim 1, wherein, The decrypting the first ciphertext data according to at least the trusted private key comprises: The data transaction terminal decrypts the first ciphertext data by using the trusted private key and the asymmetric encryption algorithm SM2.

6. The method of claim 1, wherein, Before sending the second ciphertext data and the second digital signature data to the data requester, the method further comprises: The data transaction terminal encrypts the result data by using the second public key to obtain the second ciphertext data, wherein the result data is generated after processing the trusted decryption data in the trusted computing environment, and the trusted decryption data is obtained after decrypting the first ciphertext data; First, the data transaction terminal encrypts the second ciphertext data by using the trusted private key to obtain second initial encryption data, and then encrypts the second initial encryption data by using the second public key to obtain the second digital signature data.

7. The method of claim 6, wherein, Before encrypting the result data by using the second public key to obtain the second ciphertext data, the method further comprises: The data transaction terminal receives the second public key from the data requester.

8. The method of claim 6, wherein, The encrypting the result data by using the second public key to obtain the second ciphertext data comprises: The data transaction terminal encrypts the result data by using the second public key and the asymmetric encryption algorithm SM2.

9. The method of claim 6, wherein, First, the data transaction terminal encrypts the second ciphertext data by using the trusted private key to obtain second initial encryption data, and then encrypts the second initial encryption data by using the second public key to obtain the second digital signature data, which comprises: The data transaction terminal first encrypts the second ciphertext data by using a hash algorithm SM3, the trusted private key and the asymmetric encryption algorithm SM2 to obtain second initial ciphertext; Then the data transaction terminal encrypts the second initial ciphertext by using the second public key and the asymmetric encryption algorithm SM2 to obtain the second digital signature data.

10. The method of claim 1, wherein, The encrypting the original data by using the trusted public key comprises: The data provider encrypts the original data by using the trusted public key and the asymmetric encryption algorithm SM2.

11. The method of claim 1, wherein, First, the data provider encrypts the first ciphertext data by using a hash algorithm SM3, the first private key and the asymmetric encryption algorithm SM2 to obtain first initial ciphertext; then the data provider encrypts the first initial ciphertext by using the trusted public key and the asymmetric encryption algorithm SM2 to obtain the first digital signature data. First, the data provider encrypts the first ciphertext data by using a hash algorithm SM3, the first private key and the asymmetric encryption algorithm SM2 to obtain first initial ciphertext; then the data provider encrypts the first initial ciphertext by using the trusted public key and the asymmetric encryption algorithm SM2 to obtain the first digital signature data. ​ 12. The method of any one of claims 1, 10 or 11, wherein, The method further comprises: The data provider generates a first public-private key pair comprising a first public key and the first private key; The first public key is sent to the data transaction terminal.

13. The method of claim 1, wherein, Before receiving the second ciphertext data and the second digital signature data from the data transaction terminal, the method further comprises: The data consumer generates a second public-private key pair comprising the second public key and the second private key, and sends the second public key to the data transaction terminal.

14. The method of claim 1, wherein, Verifying the second digital signature data according to at least the second private key comprises: The data consumer performs a hash operation on the second ciphertext data by using a hash algorithm SM3 to obtain a second hash value; The second digital signature data is first decrypted by using a trusted public key to obtain second initial decryption data, and then the second initial decryption data is secondly decrypted by using the second private key to obtain second decryption data; The second hash value is compared with the second decryption data to determine whether they are identical; If they are identical, the verification is passed; The trusted public-private key pair comprising the trusted public key is generated by the data transaction terminal in a trusted computing environment.

15. The method of claim 14, wherein, The second digital signature data is first decrypted by using a trusted public key to obtain second initial decryption data, and then the second initial decryption data is secondly decrypted by using the second private key to obtain second decryption data comprises: The data consumer first decrypts the second digital signature data by using the trusted public key and an asymmetric encryption algorithm SM2 to obtain second initial decryption data; Then the second initial decryption data is decrypted by using the second private key and the asymmetric encryption algorithm SM2 to obtain the second decryption data.

16. The method according to claim 14 or 15, characterized in that Before decrypting the second digital signature data by using the trusted public key and the asymmetric encryption algorithm SM2, the method further comprises: The data consumer receives the trusted public key from the data transaction terminal.

17. The method of claim 1, wherein, The second ciphertext data is decrypted according to at least the second private key comprises: The data consumer decrypts the second ciphertext data by using the second private key and the asymmetric encryption algorithm SM2.

18. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is run by a processor to perform the steps of the data transmission method according to any one of claims 1 to 17.

Images