A method and system for encrypted transmission of network data

Abstract

The present invention discloses an encryption transmission method and system for network data, comprising step S1: a key server generates a public key and multiple private keys; step S2: a request end encrypts a download request and sends it to a transit server, which encrypts it again and sends it to a data storage end; step S3: the data storage end obtains demand data based on the download request, and sends it to a first server for storage after encryption; step S4: the data storage end encrypts a label and a request end address of the first server, and sends them to a second server; step S5: the second server sends the request end address to the first server based on the label, and the first server sends data to the request end based on the request end address; by setting the second server, the present invention makes it impossible for an interceptor to obtain the identity and address of the request end even if he obtains the demand data transmitted between the data storage end and the data usage end, thereby protecting the privacy of the customer.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and in particular to a method and system for encrypting and transmitting network data. Background Art

[0002] Cryptography is a confidentiality technology in which the two communicating parties perform special information transformation according to agreed rules. The process of converting plain text into cipher text is called encryption, and the process of restoring the original plain text from cipher text is called decryption. Data encryption technology requires that the password can only be decrypted under the specified user or network to obtain the original data. This requires the sender and receiver of the data to be given some special information for encryption and decryption. This is the so-called key, and the key value is selected from a large number of random numbers.

[0003] Currently in encrypted transmission technology, in order to ensure the security of data, public keys and private keys are usually used to encrypt the transmitted content, but the sending address and receiving address of the data are not encrypted. If the data sender and receiver communicate point-to-point, there is a risk of exposing the identity and address of the sender and receiver. Summary of the invention

[0004] To solve the above problems, the present invention provides a method and system for encrypting and transmitting network data, so as to solve the problem in the prior art that the sending address and receiving address of the data are not encrypted and there is a risk of exposure.

[0005] To achieve the above object, the present invention provides a technical solution for a method for encrypting and transmitting network data, comprising:

[0006] Step S1: The key server generates a public key and multiple private keys, and sends the public key and the private key to the corresponding receiving end;

[0007] Step S2: The requesting end uses the encrypted public key in the public key and a first encrypted private key within the private key , encrypt download request , generate data , sent to the transit server, the transit server uses the first decryption private key in the private key Decrypting Data get , and then through the second encrypted private key in the private key Encrypting Data Get the data , sent to the data storage end;

[0008] Step S3: The data storage end uses the decryption public key in the public key and a second decryption private key within the private key Decrypting Data , get the download request , based on the download request Get demand data , the data storage end uses the encryption public key and a third encrypted private key within the private key Encrypt the required data Generate data , sent to the first server for storage;

[0009] Step S4: The data storage end uses the encryption public key , a fourth encrypted private key within the private key and the fifth encrypted private key , the label of the first server and the requesting end address Encrypt and generate data separately and data , sent to the second server;

[0010] Step S5: The second server uses the decryption public key and a fourth decryption private key within the private key Decrypting Data , get the label of the first server , based on this tag Determine the first server that needs to be accessed and send the data Send to the first server, the first server uses the decryption public key and the fifth decryption private key within the private key Decrypting Data After that, get the request end address , based on the requesting end address The data Sending to the requesting end;

[0011] Step S6: The requesting end uses the decryption public key and a third decryption private key within the private key Decrypting Data , obtain the demand data .

[0012] Furthermore, the key server sending the public key and the private key comprises the following steps:

[0013] Step S11: The key server stores a secret string , the first conversion key and the second conversion key , define the key that the key server needs to send as The key server converts the key based on a first formula , get the data , the first formula is: ,in Represents the exclusive OR operation;

[0014] Step S12: The key server encrypts the data based on the second formula and the third formula respectively. and the first conversion key , get the data and data , the second formula is: , the third formula is: , the data ,data and the secret string Sending to the receiving end;

[0015] Step S13: The receiving end receives the secret string based on the secret string. Calculate the recovery key , the restoration key The receiving end then restores the data based on the fourth formula and data , obtain the key , the fourth formula is: .

[0016] Furthermore, after the requesting end establishes a communication connection with the transit server, the key server regenerates the public key.

[0017] Furthermore, in step S3, the demand data is encrypted And sending it to the first server comprises the following steps:

[0018] Step S31: The data storage terminal stores the required data Split into multiple chunks , , the third encrypted private key Including multiple different sub-private keys , , the data storage end uses the encryption public key and the child private key The data block Encrypt generated data separately ;

[0019] Step S32: The data storage end stores the data Randomly sent to different first servers.

[0020] Furthermore, in step S31, the data block includes a pointer to the end address of the previous data block, and in step S6, the requesting end decrypts the data Get the data block Then, the data block is restored to the required data according to the pointer in the data block.

[0021] Furthermore, before sending the data blocks, a first hash value of each data block is calculated, and the first hash value is sent together with the data blocks. After receiving the data blocks, the requesting end calculates the second hash value of each data block again, and compares whether the first hash value and the second hash value are the same. If yes, the data block is restored to the required data; if no, the data block is retrieved.

[0022] On the other hand, the present invention also provides a system for encrypted transmission of network data, which is used to implement the above-mentioned method for encrypted transmission of network data, comprising:

[0023] A key server is used to generate public keys and private keys and send them to corresponding receiving ends;

[0024] The transfer server transfers the download request from the requesting end to the data storage end;

[0025] The first server temporarily stores the request data of the requesting end;

[0026] A second server, used for accessing the first server and sending the address of the requesting end to the first server;

[0027] The label generation unit generates a label of the first server according to the IP address and the MAC address of the first server.

[0028] Compared with the prior art, the beneficial effects of the present invention are at least as follows:

[0029] 1. The present invention sets a transit server and a first server so that the request end and the data storage end do not communicate directly, thereby reducing the risk of data being intercepted; the transit server replaces the key in the process of transmitting data, so that the ciphertext transmitted between the request end and the transit server, and between the transit server and the data storage end changes, so that even if the data received and sent by the transit server is intercepted, it is difficult for the interceptor to distinguish whether the two are the result of encrypting the same plaintext, that is, it is impossible to infer the data transmission path based on the ciphertext data, thereby protecting the confidentiality of the transmission path.

[0030] 2. By setting up a second server, even if an interceptor obtains the required data transmitted between the data storage end and the data usage end, he cannot obtain the identity and address of the requesting end, thereby protecting the privacy of the customer. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 The present invention is a flow chart of a method for encrypting and transmitting network data. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0033] It is understood that the terms "first", "second", etc. used in this application may be used herein to describe various elements, but unless otherwise specified, these elements are not limited by these terms. These terms are only used to distinguish a first element from another element. For example, without departing from the scope of this application, a first xx script may be referred to as a second xx script, and similarly, a second xx script may be referred to as a first xx script.

[0034] like Figure 1 As shown, a method for encrypting and transmitting network data includes:

[0035] Step S1: The key server generates a public key and multiple private keys, and sends the public key and the private key to the corresponding receiving end;

[0036] Step S2: The requester uses the encrypted public key in the public key and the first encrypted private key within the private key , encrypt download request , generate data , sent to the relay server, the relay server uses the first decryption private key in the private key Decrypting Data get , and then through the second encrypted private key in the private key Encrypting Data Get the data , sent to the data storage end.

[0037] By setting up a transit server, the requesting end and the data storage end can communicate data indirectly, thereby reducing the risk of data interception; before the download request is transmitted to the data storage end, the transit server replaces the first encryption private key in the download request with the second encryption private key, so that the data transmitted between the requesting end and the transit server and between the transit server and the data storage end are encrypted with different keys, and during the key replacement process, the download request is not completely decrypted in the transit server, that is, the download request remains in an undecrypted state when transmitted between the three, thereby greatly improving the confidentiality and security of data transmission.

[0038] Step S3: The data storage end uses the decryption public key in the public key and the second decrypted private key within the private key Decrypting Data , get the download request , based on the download request Get demand data , the data storage end uses the encrypted public key and a third encrypted private key within the private key Encryption requirement data Generate data , sent to the first server for storage.

[0039] In a specific embodiment, the data storage end first stores the data in the first server, and the first server then transmits the data to the request end. Through this setting, the request end and the data storage end maintain indirect communication, completing the closed-loop transmission of data between the two.

[0040] Step S4: The data storage end uses the encrypted public key , the fourth encrypted private key within the private key and the fifth encrypted private key , the label for the first server and the requesting end address Encrypt and generate data separately and data , sent to the second server;

[0041] Step S5: The second server uses the decryption public key and the fourth decryption private key within the private key Decrypting Data , get the label of the first server , based on this tag Determine the first server to be accessed and Sent to the first server, the first server uses the decryption public key and the fifth decryption private key within the private key Decrypting Data After that, get the request end address , based on the requesting end address The data Sent to the requester.

[0042] In step S4 and step S5, in order to protect the confidentiality of the address of the requesting end, the data storage end encrypts the address of the requesting end and does not send it directly to the first server, so that even if the data transmitted between the data storage end and the first server is intercepted, the interceptor cannot obtain the identity and address information of the requesting end; in a specific embodiment, there may be multiple first servers for transmitting data in the network, and the data storage end feeds back the label of the first server to the second server to ensure that the second server can smoothly transmit the address of the requesting end to the correct first server; during the transmission process, by encrypting the label of the first server, even if the data transmitted between the data storage end and the second server is leaked, if the data cannot be decrypted, the interceptor cannot know in which first server the required data is stored, thereby improving the security of data storage.

[0043] Step S6: The requesting end uses the decryption public key and the third decryption private key within the private key Decrypting Data , obtain demand data .

[0044] The present invention sets a transit server and a first server so that the request end and the data storage end do not communicate directly, thereby reducing the risk of data being intercepted; the transit server replaces the key in the process of transmitting data, so that the ciphertext transmitted between the request end and the transit server, and between the transit server and the data storage end changes, so that even if the data received and sent by the transit server are intercepted, it is difficult for the interceptor to distinguish whether the two are the results of encrypting the same plaintext, that is, it is impossible to infer the transmission path of the data based on the ciphertext data, thereby protecting the confidentiality of the transmission path; by setting the second server, even if the interceptor obtains the required data transmitted between the data storage end and the data usage end, it is impossible to obtain the identity and address of the request end, thereby protecting the privacy of the customer.

[0045] In step S1, the key server sends the public key and the private key, including the following steps:

[0046] Step S11: The key server stores a secret string , the first conversion key and the second conversion key , define the key that the key server needs to send as , the key server converts the key based on the first formula , get the data , the first formula is: ,in Represents the exclusive OR operation;

[0047] Step S12: The key server encrypts the data based on the second formula and the third formula respectively. and the first conversion key , get the data and data , the second formula is: , the third formula is: , the data ,data and the secret string Send to the receiving end;

[0048] Step S13: The receiving end receives the secret string Calculate the recovery key , restore the key The receiving end then restores the data based on the fourth formula and data , get the key , the fourth formula is: .

[0049] The fourth formula will be derived below, since , , then substituting it into the fourth formula, we get, , since the XOR operation rule satisfies the reflexivity, that is ,So ,because , , continue to substitute

[0050] Through the data and the first conversion key Encryption protects it; during transmission, and the first conversion key When all are intercepted, it can be seen from the above derivation that the data and the first conversion key Second conversion key If the data is encrypted but the corresponding decryption key is not used during the decryption process, then there is no need to transmit the decryption key. In this case, the interceptor cannot know the second conversion key because the decryption key is not transmitted during the transmission process without knowing the algorithm. The decryption key cannot be used to decrypt the data. and data Decryption greatly improves the security of data transmission.

[0051] By setting a secret string Key Encryption further improves the security of data, and in the decryption process only each secret string needs to be calculated The reciprocal of can decrypt the data, making the secret string in the key server It can be updated at any time without affecting the decryption at the receiving end, greatly improving the convenience of the decryption process.

[0052] In this embodiment, after the requesting end establishes a communication connection with the transit server, the key server regenerates the public key. This step enables the public key to be updated in a timely manner.

[0053] In this embodiment, in step S3, the encryption requirement data And sending it to the first server includes the following steps:

[0054] Step S31: The data storage terminal sends the required data Split into multiple chunks , , the third encrypted private key Including multiple different sub-private keys , , the data storage end uses the encrypted public key and child private key Block Encrypt generated data separately ;

[0055] Step S32: The data storage terminal stores the data Randomly sent to different first servers.

[0056] During the actual transmission process, if the demand data is sent as a whole, once the data is intercepted, the interceptor will obtain the entire demand data. Therefore, by dividing and encrypting the demand data, the difficulty of intercepting the data is increased, and each data block is randomly distributed to different first servers, which increases the data dispersion and avoids the situation where the outside world can obtain the demand data by attacking only one first server.

[0057] In this embodiment, in step S31, the data block contains a pointer to the end address of the previous data block. In step S6, the requesting end decrypts the data. Get data block Afterwards, the data block is restored to the required data according to the pointer in the data block.

[0058] In this embodiment, before sending the data block, the first hash value of each data block is calculated, and the first hash value is sent together with the data block. After receiving the data block, the requesting end calculates the second hash value of each data block, and compares whether the first hash value and the second hash value are the same. If yes, the data block is restored to the required data, and if no, the data block is re-acquired. Since the data is divided into multiple data blocks before transmission, the risk of data loss will increase during the transmission process. Therefore, the data receiving end verifies the data block through the hash value after receiving it, thereby verifying the integrity of the data.

[0059] On the other hand, the present invention also provides a system for encrypted transmission of network data, which is used to implement the above-mentioned method for encrypted transmission of network data, comprising:

[0060] A key server is used to generate public keys and private keys and send them to corresponding receiving ends;

[0061] The transfer server transfers the download request from the requesting end to the data storage end;

[0062] The first server temporarily stores the request data of the requesting end;

[0063] The second server is used to access the first server and send the address of the requesting end to the first server;

[0064] The label generation unit generates a label of the first server according to the IP address and MAC address of the first server.

[0065] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the above-mentioned program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0066] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0067] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

[0068] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for encrypted transmission of network data, characterized in that: include: Step S1: The key server generates a public key and multiple private keys, and sends the public key and the private key to the corresponding receiving end; Step S2: The requesting end uses the encrypted public key in the public key and a first encrypted private key within the private key , encrypt download request , generate data , sent to the transit server, the transit server uses the first decryption private key in the private key Decrypting Data get , and then through the second encrypted private key in the private key Encrypting Data Get the data , sent to the data storage end; Step S3: The data storage end uses the decryption public key in the public key and a second decryption private key within the private key Decrypting Data , get the download request , based on the download request Get demand data , the data storage end uses the encryption public key and a third encrypted private key within the private key Encrypt the required data Generate data , sent to the first server for storage; Step S4: The data storage end uses the encryption public key , a fourth encrypted private key within the private key and the fifth encrypted private key , the label of the first server and the requesting end address Encrypt and generate data separately and data , sent to the second server; Step S5: The second server uses the decryption public key and a fourth decryption private key within the private key Decrypting Data , get the label of the first server , based on this tag Determine the first server that needs to be accessed and send the data Send to the first server, the first server uses the decryption public key and the fifth decryption private key within the private key Decrypting Data After that, get the request end address , based on the requesting end address The data Sending to the requesting end; Step S6: The requesting end uses the decryption public key and a third decryption private key within the private key Decrypting Data , obtain the demand data .

2. A method for encrypted transmission of network data according to claim 1, characterized in that: In step S1, the key server sending the public key and the private key comprises the following steps: Step S11: The key server stores a secret string , the first conversion key and the second conversion key , define the key that the key server needs to send as The key server converts the key based on a first formula , get the data , the first formula is: ,in Represents XOR operation; Step S12: The key server encrypts the data based on the second formula and the third formula respectively. and the first conversion key , get the data and data , the second formula is: , the third formula is: , the data ,data and the secret string Sending to the receiving end; Step S13: The receiving end receives the secret string based on the secret string. Calculate the recovery key , the restoration key The receiving end then restores the data based on the fourth formula and data , obtain the key , the fourth formula is: .

3. A method for encrypted transmission of network data according to claim 2, characterized in that: After the requesting end establishes a communication connection with the transit server, the key server regenerates the public key.

4. The method for encrypted transmission of network data according to claim 1, characterized in that: In step S3, the demand data is encrypted And sending it to the first server comprises the following steps: Step S31: The data storage terminal stores the required data Split into multiple chunks , , the third encrypted private key Including multiple different sub-private keys , , the data storage end uses the encryption public key and the child private key The data block Encrypt generated data separately ; Step S32: The data storage end stores the data Randomly sent to different first servers.

5. A method for encrypted transmission of network data according to claim 4, characterized in that: In step S31, the data block contains a pointer to the end address of the previous data block. In step S6, the request end decrypts the data Get the data block Then, the data block is restored to the required data according to the pointer in the data block.

6. A method for encrypted transmission of network data according to claim 5, characterized in that: Before sending the data blocks, the first hash value of each data block is calculated, and the first hash value is sent together with the data blocks. After receiving the data blocks, the requesting end calculates the second hash value of each data block again, and compares whether the first hash value and the second hash value are the same. If yes, the data block is restored to the required data, and if no, the data block is re-acquired.

7. A system for encrypted transmission of network data, the system being used to implement the encrypted transmission method according to any one of claims 1 to 6, characterized in that: include: A key server is used to generate public keys and private keys and send them to corresponding receiving ends; The transfer server transfers the download request from the requesting end to the data storage end; The first server temporarily stores the request data of the requesting end; A second server, used for accessing the first server and sending the address of the requesting end to the first server; The label generation unit generates a label of the first server according to the IP address and the MAC address of the first server.

Images