A data transmission method, apparatus, device, and storage medium

Abstract

The application discloses a data transmission method and device, equipment and storage medium, relates to the field of data security, and comprises the following steps: determining a file to be shared, and acquiring a current sharing protection key and a current sharing identifier stored in a data protection server through a first mobile data protection security suite; encrypting a session key generated based on a secret key in the first mobile data protection security suite by using the current sharing protection key to obtain a first encrypted session key; generating a target encrypted file based on the first encrypted session key, the current sharing identifier and the file to be shared; and transmitting the target encrypted file to a second mobile terminal, so that the second mobile terminal decrypts the target encrypted file and stores it. The application realizes the safe migration and backup of data between different mobile terminals by encrypting the key and the file, and improves the safety and transmission efficiency of the data transmission process.

Description

Technical Field

[0001] This invention relates to the field of data security, and in particular to a data transmission method, apparatus, device, and storage medium. Background Technology

[0002] With the development of mobile work and the increasing awareness of users regarding the protection of personal privacy data, sensitive work-related information and personal privacy data on mobile terminals need to be securely stored to prevent data leakage. On the other hand, due to the need for communication, this data will be shared and transferred within a certain user range, generally using communication software to transmit over the network. During the transmission process, the security protection of sensitive and privacy data is also essential.

[0003] Existing technical solutions primarily provide users with a local file vault on mobile devices. Users first set a password for the vault and create it, then store sensitive files within it. The software uses a file protection key derived from the password to encrypt and protect the files. When users migrate files from the vault to other mobile devices or share files with friends via network tools, the files must first be decrypted from the vault, changing from protected ciphertext files to unprotected plaintext files. Therefore, this approach has the following drawbacks: using software algorithms for encryption and decryption results in low-quality random numbers for the keys, posing a risk of being cracked; sensitive data files cannot be migrated or backed up between mobile devices while in a protected state; and sensitive data files cannot be shared over the network while in a protected state. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a data transmission method, apparatus, device, and storage medium that enables secure data migration and backup between different mobile terminals, improving the security and efficiency of data transmission. The specific solution is as follows:

[0005] In a first aspect, this application discloses a data transmission method applied to a first mobile terminal, comprising:

[0006] Identify the file to be shared, and obtain the current sharing protection key and current sharing identifier stored in the data protection server through the first mobile data protection security suite;

[0007] The session key generated based on the Shield in the first mobile data protection security suite is encrypted using the currently shared protection key to obtain the first encrypted session key;

[0008] Generate a target encrypted file based on the first encryption session key, the current sharing identifier, and the file to be shared;

[0009] The target encrypted file is transmitted to the second mobile terminal so that the second mobile terminal can decrypt the target encrypted file and store it.

[0010] Optionally, before determining the file to be shared, the method further includes:

[0011] Receive the first target file, obtain the digital certificate corresponding to the first mobile terminal in the authentication system, and establish a secure channel with the data protection server;

[0012] Using the public key in the digital certificate, a first local protection key is obtained from the data protection server through the secure channel, and the first local protection key is stored in the key container of the security shield;

[0013] The system triggers a security protection operation on sensitive or private data files, and then uses the session key generated based on the security shield to encrypt the first target file to obtain the first encrypted file.

[0014] The session key is encrypted using the first local protection key through the first mobile data protection security suite to obtain the second encrypted session key;

[0015] The second encryption session key is stored in the header of the first encrypted file to obtain the second encrypted file;

[0016] The second encrypted file output by the first mobile data protection security suite is stored in a preset storage area.

[0017] Optionally, obtaining the first local protection key from the data protection server through the secure channel using the public key in the digital certificate includes:

[0018] The public key in the digital certificate is sent to the data protection server through the secure channel so that the data protection server can identify the current user of the first mobile terminal after receiving the key request, and then use the public key in the digital certificate to encrypt the first local protection key corresponding to the current user of the first mobile terminal.

[0019] The system receives the encrypted first local protection key sent by the data protection server and decrypts it using the private key stored locally that corresponds to the public key in the digital certificate to obtain the first local protection key.

[0020] Optionally, determining the file to be shared and obtaining the current sharing protection key and current sharing identifier stored in the data protection server through the first mobile data protection security suite includes:

[0021] The second encrypted file is identified as the file to be shared, and a custom sharing extraction code input by the current user of the first mobile terminal is received;

[0022] The current sharing protection key and current sharing identifier stored in the data protection server are obtained through the first mobile data protection security suite and the secure channel; both the current sharing protection key and the current sharing identifier are one-time use.

[0023] Store the current shared protection key into the security shield.

[0024] Optionally, transmitting the target encrypted file to the second mobile terminal includes:

[0025] The target encrypted file is transmitted to the second mobile terminal through a preset transmission channel;

[0026] The sharing extraction code is sent to the current user using the second mobile terminal using a preset method.

[0027] Optionally, the step of transmitting the target encrypted file to the second mobile terminal so that the second mobile terminal can decrypt the target encrypted file and store it includes:

[0028] The target encrypted file is transmitted to the second mobile terminal, so that the second mobile terminal receives the sharing extraction code input by the current user of the second mobile terminal, and obtains the current sharing protection key queried by the data protection server based on the sharing extraction code sent by the second mobile terminal and the current sharing identifier through the second mobile data protection security suite. The first encryption session key is decrypted using the current sharing protection key to obtain the session key, and then the file to be shared is decrypted using the session key to obtain the second target file. The second target file is encrypted and stored using the second local protection key, and the current sharing protection key is deleted.

[0029] Optionally, generating the target encrypted file based on the first encryption session key, the current sharing identifier, and the file to be shared includes:

[0030] The first mobile data protection security suite replaces the second encrypted session key in the file to be shared with the first encrypted session key;

[0031] The current sharing identifier is stored in the file to be shared to obtain the target encrypted file.

[0032] Secondly, this application discloses a data transmission device applied to a first mobile terminal, comprising:

[0033] The information acquisition module is used to determine the file to be shared and to obtain the current sharing protection key and current sharing identifier stored in the data protection server through the first mobile data protection security suite.

[0034] The key encryption module is used to encrypt the session key generated based on the Shield in the first mobile data protection security suite using the currently shared protection key, so as to obtain the first encrypted session key;

[0035] An encrypted file generation module is used to generate a target encrypted file based on the first encryption session key, the current sharing identifier, and the file to be shared.

[0036] The file transfer module is used to transfer the target encrypted file to the second mobile terminal so that the second mobile terminal can decrypt the target encrypted file and store it.

[0037] Thirdly, this application discloses an electronic device, including:

[0038] Memory, used to store computer programs;

[0039] A processor is configured to execute the computer program to implement the steps of the data transmission method disclosed above.

[0040] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the data transmission method disclosed above.

[0041] As can be seen, this application provides a data transmission method, including: determining a file to be shared, and obtaining a current sharing protection key and a current sharing identifier stored in a data protection server through a first mobile data protection security suite; encrypting a session key generated based on a security shield in the first mobile data protection security suite using the current sharing protection key to obtain a first encrypted session key; generating a target encrypted file based on the first encrypted session key, the current sharing identifier, and the file to be shared; and transmitting the target encrypted file to a second mobile terminal so that the second mobile terminal can decrypt and store the target encrypted file. Therefore, this application obtains the current sharing protection key and the current sharing identifier from a data protection server before sharing the file, and shares the target encrypted file composed of the session key encrypted with the current sharing protection key, the current sharing identifier, and the file to be shared to the second mobile terminal. This ensures that both the file and the key are encrypted during data transmission, thereby achieving secure data migration and backup between different mobile terminals and improving the security and efficiency of data transmission. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0043] Figure 1 This is a flowchart of a data transmission method disclosed in this application;

[0044] Figure 2 This is a schematic diagram of a mobile terminal structure disclosed in this application;

[0045] Figure 3 This is a flowchart of a specific data transmission method disclosed in this application;

[0046] Figure 4 This is a schematic diagram of a local data protection method disclosed in this application;

[0047] Figure 5 This is a flowchart of a specific data transmission method disclosed in this application;

[0048] Figure 6 This is a schematic diagram of a data file sharing over a network disclosed in this application;

[0049] Figure 7 This is a schematic diagram of the data transmission device structure provided in this application;

[0050] Figure 8 This application provides a structural diagram of an electronic device. Detailed Implementation

[0051] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0052] Currently, existing technical solutions mainly provide users with local file vaults on mobile terminals. Users first set a password for the vault and create it, then store sensitive files within it. The software uses a file protection key derived from the password to encrypt and protect the files. When users migrate files from the vault to other mobile devices or share files with friends via network tools, the files must first be decrypted from the vault, changing from protected ciphertext files to unprotected plaintext files. Therefore, this approach has the following drawbacks: using software algorithms for encryption and decryption results in low-quality random numbers for the keys, posing a risk of being cracked; sensitive data files cannot be migrated and backed up between mobile devices while in a protected state; and sensitive data files cannot be shared over the network while in a protected state. To address these issues, this application provides a data transmission method that enables secure data migration and backup between different mobile terminals, improving the security and efficiency of the data transmission process.

[0053] This invention discloses a data transmission method, see [link to relevant documentation]. Figure 1 As shown, applied to a first mobile terminal, the method includes:

[0054] Step S11: Determine the file to be shared, and obtain the current sharing protection key and current sharing identifier stored in the data protection server through the first mobile data protection security suite.

[0055] In this embodiment, a file to be shared is determined, and the current sharing protection key and current sharing identifier stored in the data protection server are obtained through the first mobile data protection security suite. It is understood that after determining the file to be shared, the data protection server is accessed through the first mobile data protection security suite. At this time, the data access server receives a data sharing request sent by the first mobile terminal, then randomly generates a one-time current sharing protection key and current sharing identifier, and then stores the current sharing protection key in the key container of the security shield.

[0056] It should be pointed out that, as Figure 2As shown, the mobile application (APP, third-party application) encrypts and protects data by calling a data protection security suite. The mobile terminal contains a mobile data protection security suite, which includes a data encryption / decryption interface and a security shield. Key calculations can be performed within the security shield, which also contains a key container storing the local protection key, the currently shared protection key, the user's private key, and the digital certificate. Furthermore, the mobile data protection security suite establishes a secure channel directly with the data protection server, and information exchange between the two ends is achieved through this secure channel. It should be noted that all key generation, calculation, and storage operations on the mobile terminal use the security shield. The use of the security shield instead of typical software algorithms in key operations for data protection provides higher security in terms of random number quality, key calculation security, and key storage security. Moreover, the key hierarchy design is based on the mobile terminal's encrypted private key rather than its derivatives, thus ensuring strong confidentiality. Sensitive information such as session keys and shared extraction codes rely on the key hierarchy for encryption protection, resulting in high security during network transmission.

[0057] Understandably, the data protection security suite uses a highly secure shield to create a key container for the application and perform key operations within the secure space of the shield. It establishes a secure channel using digital certificate technology and a data protection server. The data protection security suite uses different protection keys to encrypt and protect local and shared data files, achieving high-security protection for data files.

[0058] Step S12: Encrypt the session key generated based on the Shield in the first mobile data protection security suite using the current shared protection key to obtain the first encrypted session key.

[0059] In this embodiment, the current sharing protection key is used to encrypt the session key generated based on the security token in the first mobile data protection suite to obtain the first encrypted session key. It is understood that after storing the current sharing protection key obtained from the data protection server in the security token's key container, the data security suite calls the security token to generate a session key, and uses the session key to encrypt the file to be shared. Then, the current sharing protection key is used to encrypt the session key to obtain the first encrypted session key. It should be noted that the steps of generating the session key and using it to encrypt the file to be shared also apply when the first mobile terminal receives and stores received data.

[0060] Step S13: Generate a target encrypted file based on the first encryption session key, the current sharing identifier, and the file to be shared.

[0061] In this embodiment, a target encrypted file is generated based on the first encryption session key, the current sharing identifier, and the file to be shared. It is understood that the first encryption session key is appended to the header of the encrypted file to be shared, and when the file is shared, the unique current sharing identifier (share_id) is simultaneously appended to the header of the encrypted file to be shared, resulting in the target encrypted file.

[0062] Understandably, once data files are protected, users can easily migrate them between different mobile devices without incurring any loss of data security, and can also easily share data files quickly through common online tools (such as WeChat) without incurring any loss of data security.

[0063] Step S14: The target encrypted file is transmitted to the second mobile terminal so that the second mobile terminal can decrypt the target encrypted file and store it.

[0064] In this embodiment, the target encrypted file is transmitted to the second mobile terminal so that the second mobile terminal can decrypt and store the target encrypted file. It is understood that the file to be shared in the target encrypted file is encrypted, and the session key used for decryption is also encrypted, thus improving data security during transmission. After the target encrypted file is transmitted to the second mobile terminal, the current user of the second mobile terminal can conveniently use the second data protection security suite in the second mobile terminal to receive the target encrypted file, and simultaneously use the local data protection key of the second mobile terminal to securely store the data file, ensuring that the data file is securely protected throughout the entire process involving the first mobile terminal, the transmission network, and the second mobile terminal. Furthermore, the data transmission tool can be a common commercially available software tool such as WeChat, DingTalk, or enterprise IM (instant messaging software), or other data transmission tools can be selected to complete the network transmission.

[0065] It is understandable that the protection of data files on mobile terminals adopts a hierarchical structure of session keys, local protection keys, and digital certificate keys. The local protection key and the shared protection key, as well as the mutual encryption between the two, are used to achieve secure and efficient data file transfer under protection, including: local storage on mobile terminals, cross-device migration of mobile terminals, sharing between different users, and local storage of received shared files. In all these processes, the encryption operation of the entire file is performed only once.

[0066] As can be seen, this application provides a data transmission method, including: determining a file to be shared, and obtaining a current sharing protection key and a current sharing identifier stored in a data protection server through a first mobile data protection security suite; encrypting a session key generated based on a security shield in the first mobile data protection security suite using the current sharing protection key to obtain a first encrypted session key; generating a target encrypted file based on the first encrypted session key, the current sharing identifier, and the file to be shared; and transmitting the target encrypted file to a second mobile terminal so that the second mobile terminal can decrypt and store the target encrypted file. Therefore, this application obtains the current sharing protection key and the current sharing identifier from a data protection server before sharing the file, and shares the target encrypted file composed of the session key encrypted with the current sharing protection key, the current sharing identifier, and the file to be shared to the second mobile terminal. This ensures that both the file and the key are encrypted during data transmission, thereby achieving secure data migration and backup between different mobile terminals and improving the security and efficiency of data transmission.

[0067] See Figure 3 As shown, this embodiment of the invention discloses a data transmission method. Compared with the previous embodiment, this embodiment further explains and optimizes the technical solution.

[0068] Step S21: Receive the first target file, obtain the digital certificate corresponding to the first mobile terminal in the authentication system, and establish a secure channel with the data protection server.

[0069] In this embodiment, a first target file is received, a digital certificate corresponding to the first mobile terminal in the authentication system is obtained, and a secure channel is established with the data protection server. It is understood that when the first mobile terminal receives the first target file, it first needs to obtain the digital certificate and establish a secure channel with the data protection server.

[0070] Step S22: Use the public key in the digital certificate to obtain the first local protection key from the data protection server through the secure channel, and store the first local protection key in the key container of the security shield.

[0071] In this embodiment, after establishing a secure channel with the data protection server, the first local protection key is obtained from the data protection server through the secure channel using the public key in the digital certificate, and then stored in the key container of the security shield. It can be understood that the first mobile terminal uses the encryption public key in the digital certificate to securely obtain the first local protection key from the data protection server and stores the first local protection key in the key container of the security shield. Specifically, as... Figure 4As shown, the public key in the digital certificate is sent to the data protection server through the secure channel. Upon receiving the key request, the data protection server identifies the current user of the first mobile terminal, then uses the public key in the digital certificate to encrypt the first local protection key corresponding to the current user of the first mobile terminal, and returns the encrypted first local protection key to the first mobile terminal. After receiving the encrypted first local protection key from the data protection server, the first mobile terminal decrypts it using the private key stored locally that corresponds to the public key in the digital certificate to obtain the first local protection key `private_cpk`, and then stores the first local protection key in the key container of the security shield. It should be noted that one user corresponds to only one local protection key; that is, the data protection server queries and returns the local protection key corresponding to the current user by identifying the current user.

[0072] Step S23: Trigger a security protection operation on sensitive data files or private data files, and then encrypt the first target file using the session key generated based on the security shield to obtain the first encrypted file.

[0073] In this embodiment, after storing the first local protection key, a security protection operation for the sensitive data file or privacy data file is triggered. Then, the first target file is encrypted using the session key generated based on the security shield to obtain the first encrypted file. It can be understood that the sensitive data file or privacy data file is the received first target file, then the security shield in the first mobile data protection security suite is invoked to generate a session key, and then the first target file is encrypted using the session key to obtain the first encrypted file.

[0074] Step S24: Encrypt the session key using the first local protection key through the first mobile data protection security suite to obtain the second encrypted session key.

[0075] In this embodiment, after obtaining the first encrypted file, the session key is encrypted using the first local protection key through the first mobile data protection security suite to obtain the second encrypted session key. It is understood that encrypting the session key using the first local protection key improves the security of the session key, thereby enhancing the security of the first target file encrypted using the session key.

[0076] Step S25: Store the second encryption session key in the header of the first encryption file to obtain the second encryption file.

[0077] In this embodiment, the second encryption session key is stored in the header of the first encrypted file to obtain the second encrypted file. It is understood that the first encrypted file does not contain the second encryption session key, therefore the second encryption session key needs to be stored in the header of the first encrypted file.

[0078] Step S26: Store the second encrypted file output by the first mobile data protection security suite to a preset storage area.

[0079] In this embodiment, the second encrypted file output by the first mobile data protection security suite is stored in a preset storage area. It can be understood that by outputting the second encrypted file through the first mobile data protection security suite and storing it in the preset storage area of ​​the first mobile terminal, local secure data storage is achieved. It should be noted that after storing the second encrypted file, the user can migrate the second encrypted file across different terminal devices. Specifically, as... Figure 4 As shown, the second encrypted file is sent to the second mobile terminal. The current user of the second mobile terminal views the contents of the data file. The second mobile data protection security suite of the second mobile terminal securely obtains the local protection key of the current user from the data protection server, and then uses the obtained local protection key to decrypt the session key, thereby decrypting the second encrypted file. Then, the second mobile data protection security suite calls the security shield to complete the file decryption within the security shield's secure space.

[0080] Step S27: Determine the file to be shared, and obtain the current sharing protection key and current sharing identifier stored in the data protection server through the first mobile data protection security suite.

[0081] Step S28: Encrypt the session key generated based on the Shield in the first mobile data protection security suite using the current shared protection key to obtain the first encrypted session key.

[0082] Step S29: Generate a target encrypted file based on the first encryption session key, the current sharing identifier, and the file to be shared.

[0083] Step S210: The target encrypted file is transmitted to the second mobile terminal so that the second mobile terminal can decrypt the target encrypted file and store it.

[0084] For details regarding steps S27 to S210, please refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0085] As can be seen, this embodiment of the application receives a first target file, obtains a digital certificate corresponding to the first mobile terminal in the authentication system, and establishes a secure channel with the data protection server; uses the public key in the digital certificate to obtain a first local protection key from the data protection server through the secure channel, and stores the first local protection key in the key container of the security shield; triggers a security protection operation for sensitive data files or privacy data files, and then uses the session key generated based on the security shield to encrypt the first target file to obtain a first encrypted file; uses the first mobile data protection security suite to encrypt the session key using the first local protection key to obtain a second encrypted session key; stores the second encrypted session key in the header of the first encrypted file to obtain a second encrypted file; and stores the second encrypted file output by the first mobile data protection security suite in a preset storage area, thus completing the secure storage of data and improving the security of data migration and backup between different mobile terminals.

[0086] See Figure 5 As shown, this embodiment of the invention discloses a data transmission method. Compared with the previous embodiment, this embodiment further explains and optimizes the technical solution.

[0087] Step S31: Determine the second encrypted file as the file to be shared, and receive the custom sharing extraction code input by the current user of the first mobile terminal.

[0088] In this embodiment, the second encrypted file is determined as the file to be shared, and a custom sharing extraction code input by the current user of the first mobile terminal is received. It is understood that, as... Figure 6 As shown, the second encrypted file is selected from the preset storage area of ​​the first mobile terminal and determined as the file to be shared. Then, a custom sharing extraction code is received from the current user of the first mobile terminal. The current user of the second mobile terminal receiving the data must enter the same sharing extraction code to obtain the corresponding data file.

[0089] Step S32: Obtain the current sharing protection key and current sharing identifier stored in the data protection server through the first mobile data protection security suite and the secure channel; both the current sharing protection key and the current sharing identifier are one-time use.

[0090] In this embodiment, after receiving the custom sharing extraction code input by the current user of the first mobile terminal, the current sharing protection key and the current sharing identifier stored in the data protection server are obtained through the first mobile data protection security suite and the secure channel; both the current sharing protection key and the current sharing identifier are one-time use. It can be understood that the first mobile terminal sends a data sharing request to the data protection server, then obtains the current sharing protection key (share_cpk) and the current sharing identifier generated based on this data sharing request from the data server, and stores the current sharing protection key in the key container of the security shield.

[0091] Step S33: Encrypt the session key generated based on the Shield in the first mobile data protection security suite using the current shared protection key to obtain the first encrypted session key.

[0092] In this embodiment, the session key generated based on the Shield in the first Mobile Data Protection Security Suite is encrypted using the current sharing protection key to obtain the first encrypted session key. It can be understood that the first Mobile Data Protection Security Suite calls Shield to perform key calculation, and uses the current sharing protection key share_cpk to encrypt the session key in the file to be shared, thus obtaining the first encrypted session key.

[0093] Step S34: Replace the second encrypted session key in the file to be shared with the first encrypted session key using the first mobile data protection security suite.

[0094] In this embodiment, the first mobile data protection security suite replaces the second encrypted session key in the file to be shared with the first encrypted session key. It is understood that the header of the second encrypted file, which is determined to be the file to be shared, contains the second encrypted session key, which is encrypted using the first local protection key. The second encrypted session key is obtained by encrypting the session key using the first local protection key; it is an encryption process used for local storage. Therefore, during data sharing, the second encrypted session key needs to be replaced with the first encrypted session key obtained by encrypting the session key using the current sharing protection key.

[0095] Step S35: Store the current sharing identifier into the file to be shared to obtain the target encrypted file.

[0096] In this embodiment, the current sharing identifier is stored in the file to be shared to obtain the target encrypted file. It is understood that the sharing protection key of the file to be shared has a globally unique identifier, namely the current sharing identifier; therefore, the current sharing identifier is also stored in the header of the file to be shared to obtain the target encrypted file.

[0097] Step S36: The target encrypted file is transmitted to the second mobile terminal so that the second mobile terminal can decrypt the target encrypted file and store it.

[0098] In this embodiment, the target encrypted file is transmitted to a second mobile terminal so that the second mobile terminal can decrypt and store the target encrypted file. It is understood that the target encrypted file is transmitted to the second mobile terminal through a preset transmission channel, which can be a common network tool, such as WeChat or other communication software. Simultaneously, the sharing extraction code is sent to the current user of the second mobile terminal using a preset method, such as user-to-user communication. If the sharing extraction code is transmitted over the network, it needs to be encrypted using a local protection key. It should be noted that transmitting the target encrypted file to the second mobile terminal, such as... Figure 6 As shown, after receiving the sharing extraction code input by the current user of the second mobile terminal, the sharing extraction code, as sensitive information, is encrypted by the second local protection key and sent to the data server. The data server queries the corresponding sharing protection key based on the extraction code and the current sharing identifier (share_id), and securely sends it to the second mobile terminal using a digital certificate to encrypt the public key. It can be understood that the data protection server can accurately retrieve the key information corresponding to the data file based on the sharing extraction code and the current sharing identifier. Then, the second mobile terminal uses the private key stored in the security shield to decrypt and obtain the sharing protection key. The second mobile data protection security suite securely stores the sharing protection key in the security shield, then uses the sharing protection key to decrypt and obtain the session key. The session key is then used to decrypt the file to be shared to obtain the second target file for viewing. Simultaneously, the session key is encrypted and protected using the second local protection key, and the ciphertext field of the session key corresponding to the header of the data file is modified to complete the secure local storage. The second local protection key is the local protection key corresponding to the current user. It should be noted that since both the current sharing protection key and the current sharing identifier are one-time use, they need to be destroyed after the file is stored locally.

[0099] As can be seen, this embodiment of the application determines the second encrypted file as the file to be shared, receives a custom sharing extraction code input by the current user of the first mobile terminal; obtains the current sharing protection key and current sharing identifier stored in the data protection server through the first mobile data protection security suite and the secure channel; encrypts the session key generated based on the encryption shield in the first mobile data protection security suite using the current sharing protection key to obtain a first encrypted session key; replaces the second encrypted session key in the file to be shared with the first encrypted session key through the first mobile data protection security suite; stores the current sharing identifier in the file to be shared to obtain the target encrypted file; and transmits the target encrypted file to the second mobile terminal so that the second mobile terminal can decrypt and store the target encrypted file, thereby realizing secure migration and backup of data between different mobile terminals, improving the security and efficiency of data transmission.

[0100] See Figure 7 As shown in the illustration, this application also discloses a data transmission device applied to a first mobile terminal, comprising:

[0101] Information acquisition module 11 is used to determine the file to be shared and to obtain the current sharing protection key and current sharing identifier stored in the data protection server through the first mobile data protection security suite;

[0102] The key encryption module 12 is used to encrypt the session key generated based on the Shield in the first mobile data protection security suite using the currently shared protection key, so as to obtain the first encrypted session key;

[0103] Encrypted file generation module 13 is used to generate a target encrypted file based on the first encryption session key, the current sharing identifier, and the file to be shared;

[0104] The file transfer module 14 is used to transfer the target encrypted file to the second mobile terminal so that the second mobile terminal can decrypt the target encrypted file and store it.

[0105] As can be seen, this application includes: determining the file to be shared, and obtaining the current sharing protection key and current sharing identifier stored in the data protection server through a first mobile data protection security suite; encrypting the session key generated based on the encryption key in the first mobile data protection security suite using the current sharing protection key to obtain a first encrypted session key; generating a target encrypted file based on the first encrypted session key, the current sharing identifier, and the file to be shared; and transmitting the target encrypted file to a second mobile terminal so that the second mobile terminal can decrypt and store the target encrypted file. Therefore, this application obtains the current sharing protection key and current sharing identifier from the data protection server before sharing the file, and shares the target encrypted file composed of the session key encrypted with the current sharing protection key, the current sharing identifier, and the file to be shared to the second mobile terminal. This ensures that both the file and the key are encrypted during data transmission, thereby achieving secure data migration and backup between different mobile terminals and improving the security and efficiency of data transmission.

[0106] In some specific embodiments, the information acquisition module 11 specifically includes:

[0107] A secure channel establishment unit is used to receive a first target file, obtain a digital certificate corresponding to the first mobile terminal in the authentication system, and establish a secure channel with the data protection server.

[0108] A public key sending unit is used to send the public key in the digital certificate to the data protection server through the secure channel, so that after receiving the key request, the data protection server can identify the current user of the first mobile terminal and then use the public key in the digital certificate to encrypt the first local protection key corresponding to the current user of the first mobile terminal.

[0109] The first local protection key acquisition unit is used to receive the encrypted first local protection key sent by the data protection server, and decrypt it using the private key stored locally that corresponds to the public key in the digital certificate to obtain the first local protection key.

[0110] The first local protection key storage unit is used to store the first local protection key into the key container of the security shield;

[0111] The first encrypted file acquisition unit is used to trigger a security protection operation on a sensitive data file or a private data file, and then encrypt the first target file using the session key generated based on the crypto shield to obtain the first encrypted file;

[0112] A session key encryption unit is used to encrypt the session key using the first local protection key through the first mobile data protection security suite to obtain a second encrypted session key;

[0113] The second encrypted file acquisition unit is used to store the second encrypted session key into the header of the first encrypted file to obtain the second encrypted file;

[0114] The second encrypted file storage unit is used to store the second encrypted file output by the first mobile data protection security suite to a preset storage area;

[0115] The file to be shared determination unit is used to determine the second encrypted file as the file to be shared;

[0116] The extraction code receiving unit is used to receive a custom sharing extraction code input by the current user of the first mobile terminal;

[0117] The sharing protection key and identifier acquisition unit is used to acquire the current sharing protection key and current sharing identifier stored in the data protection server through the first mobile data protection security suite and the secure channel; both the current sharing protection key and the current sharing identifier are one-time use.

[0118] A shared protection key storage unit is used to store the current shared protection key in the security shield.

[0119] In some specific embodiments, the encrypted file generation module 13 specifically includes:

[0120] An encrypted session key replacement unit is used to replace the second encrypted session key in the file to be shared with the first encrypted session key through the first mobile data protection security suite;

[0121] The target encrypted file generation unit is used to store the current sharing identifier into the file to be shared in order to obtain the target encrypted file.

[0122] In some specific embodiments, the file transfer module 14 specifically includes:

[0123] The file transfer unit is used to transfer the target encrypted file to the second mobile terminal, so that the second mobile terminal receives the sharing extraction code input by the current user of the second mobile terminal, and obtains the current sharing protection key queried by the data protection server based on the sharing extraction code sent by the second mobile terminal and the current sharing identifier through the second mobile data protection security suite, decrypts the first encryption session key with the current sharing protection key to obtain the session key, then decrypts the file to be shared with the session key to obtain the second target file, encrypts and stores the second target file with the second local protection key, and deletes the current sharing protection key;

[0124] The extraction code sending unit is used to send the sharing extraction code to the current user using the second mobile terminal through a preset method.

[0125] Furthermore, embodiments of this application also provide an electronic device. Figure 8 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0126] Figure 8 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the data transmission method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0127] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0128] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0129] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs capable of performing the data transmission method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0130] Furthermore, this application also discloses a storage medium storing a computer program, which, when loaded and executed by a processor, implements the data transmission method steps disclosed in any of the foregoing embodiments.

[0131] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0132] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0133] The present invention has provided a detailed description of a data transmission method, apparatus, device, and storage medium. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A data transmission method, characterized by, Applied to a first mobile terminal, comprising: determine the file to be shared, and obtain the current sharing protection key and the current sharing identifier stored in the data protection server through the first mobile data protection security suite; encrypt the session key generated based on the secret shield in the first mobile data protection security suite using the current sharing protection key to obtain a first encrypted session key; generate a target encrypted file based on the first encrypted session key, the current sharing identifier, and the file to be shared; transmit the target encrypted file to a second mobile terminal so that the second mobile terminal decrypts the target encrypted file and stores it; wherein, before determining the file to be shared, further comprising: receive a first target file, obtain a digital certificate corresponding to the first mobile terminal in an authentication system, and establish a secure channel with the data protection server; obtain a first local protection key from the data protection server through the secure channel using the public key in the digital certificate, and store the first local protection key in the key container of the secret shield; trigger a security protection operation on sensitive data files or private data files, and then encrypt the first target file using the session key generated based on the secret shield to obtain a first encrypted file; encrypt the session key using the first local protection key through the first mobile data protection security suite to obtain a second encrypted session key; store the second encrypted session key in the header of the first encrypted file to obtain a second encrypted file; store the second encrypted file output by the first mobile data protection security suite in a preset storage area.

2. The data transmission method of claim 1, wherein, The use of the public key in the digital certificate to obtain the first local protection key from the data protection server through the secure channel comprises: send the public key in the digital certificate to the data protection server through the secure channel, so that the data protection server identifies the current user of the first mobile terminal after receiving the key request, and then encrypts the first local protection key corresponding to the current user of the first mobile terminal using the public key in the digital certificate; receive the encrypted first local protection key sent by the data protection server, and decrypt it using the private key corresponding to the public key in the digital certificate stored locally to obtain the first local protection key.

3. The data transmission method of claim 1, wherein, The determination of the file to be shared, and the obtaining of the current sharing protection key and the current sharing identifier stored in the data protection server through the first mobile data protection security suite comprises: determine the second encrypted file as the file to be shared, and receive a custom sharing extraction code input by the current user of the first mobile terminal; obtain the current sharing protection key and the current sharing identifier stored in the data protection server through the first mobile data protection security suite and using the secure channel; the current sharing protection key and the current sharing identifier are both one-time; store the current sharing protection key in the secret shield.

4. The data transmission method of claim 3, wherein, The transmission of the target encrypted file to the second mobile terminal comprises: transmit the target encrypted file to a second mobile terminal through a preset transmission channel; send the sharing extraction code to a current user using the second mobile terminal through a preset method.

5. The data transmission method of claim 4, wherein, The target encrypted file is transmitted to the second mobile terminal, so that the second mobile terminal decrypts the target encrypted file and stores it. The target encrypted file is transmitted to the second mobile terminal, so that the second mobile terminal receives the sharing extraction code input by the current user of the second mobile terminal, and through the second mobile data protection security suite, the data protection server based on the sharing extraction code sent by the second mobile terminal and the current sharing identifier queries the current sharing protection key, uses the current sharing protection key to decrypt the first encrypted session key to obtain the session key, then uses the session key to decrypt the to-be-shared file to obtain a second target file, encrypts and stores the second target file using a second local protection key, and deletes the current sharing protection key.

6. The data transmission method according to any one of claims 2 to 5, characterized in that, The target encrypted file is generated based on the first encrypted session key, the current sharing identifier, and the to-be-shared file, including: The first mobile data protection security suite replaces the second encrypted session key in the to-be-shared file with the first encrypted session key; The current sharing identifier is stored in the to-be-shared file to obtain the target encrypted file.

7. A data transmission apparatus, characterized by comprising: Applied to a first mobile terminal, including: An information acquisition module is configured to determine a to-be-shared file and acquire a current sharing protection key and a current sharing identifier stored in a data protection server through a first mobile data protection security suite; A key encryption module is configured to encrypt a session key generated based on a secret shield in the first mobile data protection security suite using the current sharing protection key to obtain a first encrypted session key; An encrypted file generation module is configured to generate a target encrypted file based on the first encrypted session key, the current sharing identifier, and the to-be-shared file; A file transmission module is configured to transmit the target encrypted file to a second mobile terminal, so that the second mobile terminal decrypts the target encrypted file and stores it. The information acquisition module is specifically configured to, before determining a file to be shared, receive a first target file, acquire a digital certificate corresponding to the first mobile terminal in an authentication system, and establish a secure channel with a data protection server; acquire a first local protection key from the data protection server through the secure channel by using a public key in the digital certificate, and store the first local protection key into a key container of the secret shield; trigger a security protection operation on a sensitive data file or a private data file, and then encrypt the first target file by using the session key generated based on the secret shield to obtain a first encrypted file; encrypt the session key by using the first local protection key through the first mobile data protection security suite to obtain a second encrypted session key; store the second encrypted session key into a header of the first encrypted file to obtain a second encrypted file; and store the second encrypted file output by the first mobile data protection security suite into a preset storage area.

8. An electronic device, comprising: Comprise: a memory for saving a computer program; a processor for executing the computer program to implement the steps of the data transmission method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, for storing a computer program; wherein the computer program is executed by a processor to implement the data transmission method according to any one of claims 1 to 6.

Images