Data transmission method and apparatus, electronic device, and computer-readable medium

Abstract

This invention relates to a data transmission method, apparatus, computer equipment, and storage medium. The method includes two steps: key exchange and data transmission. The key exchange process involves preparing the key required for the data transmission process. The data transmission process involves the client using the key obtained in the key exchange process to encrypt, sign, decrypt, and verify the transmitted data. Similarly, the server also uses the corresponding key to encrypt, sign, decrypt, and verify the transmitted data. During the key exchange process, the SM2 asymmetric encryption algorithm is used to encrypt the key, providing security for key transmission. During the data transmission process, the SM4 symmetric encryption algorithm is used to encrypt and decrypt the message, and SM2 and SM3 are used to sign and verify the message to ensure the security and tamper-proof nature of the message transmission.

Description

Technical Field

[0001] This invention relates to the field of data privacy protection, and in particular to data transmission methods, apparatus, electronic devices, and computer-readable media. Background Technology

[0002] Existing message transmission methods (such as smart POS terminals) generally use international algorithms to encrypt and decrypt transmitted data. However, these international algorithms cannot meet the data transmission requirements of some clients and servers with high data security needs. For example, direct bank-enterprise connection systems push data directly, lacking security measures such as identity authentication, secure encryption, and digital signatures.

[0003] The inventors discovered that using Chinese national cryptographic algorithms can break free from the control of international algorithms and improve algorithm security. To protect personal user information, Chinese national cryptographic algorithms have been widely promoted in recent years. Summary of the Invention

[0004] Based on this, embodiments of the present invention provide a data transmission method, apparatus, electronic device, and computer-readable medium to solve the technical problem that the prior art cannot meet the security requirements of data transmission between the client and the server.

[0005] The first aspect provides a data transmission method applied to a client, the transmission method comprising:

[0006] The first public key and its corresponding first private key are generated using the SM2 national cryptographic algorithm, the symmetric key is generated using the SM4 national cryptographic algorithm, and a first combination containing the client user identifier and the first public key is generated.

[0007] The first combination is encrypted with the symmetric key to obtain the encrypted ciphertext of the first combination.

[0008] The symmetric key is encrypted using the server's public key to obtain symmetric key encrypted ciphertext, wherein the server's public key is the server's public key returned by the server.

[0009] The first combined encrypted ciphertext and the symmetric key encrypted ciphertext are sent to the server so that the server can decrypt them to obtain the first public key and the symmetric key. The first public key is used to encrypt the second public key to obtain the second public key encrypted ciphertext. The symmetric key is used to encrypt the second public key encrypted ciphertext and the master key to obtain the second combined encrypted ciphertext.

[0010] Receive the second combined encrypted ciphertext returned by the server;

[0011] The second combination of encrypted ciphertext is decrypted to obtain the master key and the second public key.

[0012] In one embodiment, the step of decrypting the second combined encrypted ciphertext to obtain the master key and the second public key includes:

[0013] Decrypt the second combined encrypted ciphertext using the symmetric key to obtain the encrypted ciphertext of the master key and the second public key;

[0014] The second public key is obtained by decrypting the ciphertext encrypted with the second public key using the first private key.

[0015] In one embodiment, after decrypting the second combined encrypted ciphertext to obtain the master key and the second public key, the method further includes:

[0016] The first message to be sent by the client is encrypted to obtain the encrypted ciphertext of the first message, and the first message is signed to obtain the first signed message;

[0017] The first header, the encrypted first message, and the first signed message are combined to form the first transmission data and sent to the server.

[0018] In one embodiment, encrypting the first message to be sent by the client to obtain a first message encrypted ciphertext, and signing the first message to obtain a first signed message, includes:

[0019] Determine the first header and the first message content of the first message to be sent by the client;

[0020] The content of the first message is encrypted using the master key to obtain the encrypted ciphertext of the first message;

[0021] Perform a hash calculation on the first header and the first message content to obtain the first hash value;

[0022] The first hash value is signed using the first private key to obtain the first signed message.

[0023] The first aspect provides a data transmission method applied to a server, the transmission method comprising:

[0024] The second public key and its corresponding second private key are generated using the SM2 national cryptographic algorithm, and the master key is generated using the SM4 national cryptographic algorithm.

[0025] Receive the first combination of encrypted ciphertext and symmetric key encrypted ciphertext sent by the client;

[0026] Decrypt the first combined encrypted ciphertext and the symmetric key encrypted ciphertext to obtain the symmetric key and the first public key;

[0027] The second public key is encrypted with the first public key to obtain the ciphertext encrypted with the second public key.

[0028] The second combination of the second public key ciphertext and the master key is encrypted using the symmetric key to obtain the second combination ciphertext.

[0029] The second combination of encrypted ciphertext is sent to the client so that the client can decrypt the second combination of encrypted ciphertext to obtain the second public key and the master key.

[0030] In one embodiment, the step of decrypting the first combined encrypted ciphertext and the symmetric key encrypted ciphertext to obtain the symmetric key and the first public key includes:

[0031] The symmetric key is obtained by decrypting the ciphertext encrypted with the symmetric key using the server's private key.

[0032] The first combined encrypted ciphertext is decrypted using the symmetric key to obtain the first public key.

[0033] In one embodiment, after sending the second combined encrypted ciphertext to the client, the method further includes:

[0034] Receive the first transmitted data from the client;

[0035] The first transmitted data is decrypted and verified.

[0036] If the verification passes, the first message of the client is obtained based on the first transmitted data;

[0037] Based on the first message, the second message from the server is obtained;

[0038] The second message is encrypted and signed to obtain the second transmission data, which is then sent to the client.

[0039] The third aspect provides a data transmission device, configured on a client, comprising:

[0040] The first key module is used to generate a first public key and its corresponding first private key using the SM2 national cryptographic algorithm, generate a symmetric key using the SM4 national cryptographic algorithm, and generate a first combination containing the client user identifier and the first public key.

[0041] The first encryption module is used to encrypt the first combination with the symmetric key to obtain the first combination encrypted ciphertext, and to encrypt the symmetric key with the server public key to obtain the symmetric key encrypted ciphertext, wherein the server public key is the server public key returned by the server.

[0042] The first sending module is used to send the first combined encrypted ciphertext and the symmetric key encrypted ciphertext to the server, so that the server can decrypt them to obtain the first public key and the symmetric key, encrypt the second public key with the first public key to obtain the second public key encrypted ciphertext, and encrypt the second public key encrypted ciphertext and the master key with the symmetric key to obtain the second combined encrypted ciphertext.

[0043] The first receiving module is used to receive the second combined encrypted ciphertext returned by the server;

[0044] The first decryption module is used to decrypt the second combined encrypted ciphertext to obtain the master key and the second public key.

[0045] The fourth aspect provides a data transmission device, disposed on a server, comprising:

[0046] The second key module is used to generate the second public key and its corresponding second private key using the SM2 national cryptographic algorithm, and to generate the master key using the SM4 national cryptographic algorithm.

[0047] The second receiving module is used to receive the first combined encrypted ciphertext and symmetric key encrypted ciphertext sent by the client.

[0048] The second decryption module is used to decrypt the first combined encrypted ciphertext and the symmetric key encrypted ciphertext to obtain the symmetric key and the first public key;

[0049] The second encryption module is used to encrypt the second public key with the first public key to obtain the second public key encrypted ciphertext, and to encrypt the second public key encrypted ciphertext and the master key with the symmetric key to obtain the second combination encrypted ciphertext;

[0050] The second sending module is used to send the second combined encrypted ciphertext to the client, so that the client can decrypt the second combined encrypted ciphertext to obtain the second public key and the master key.

[0051] A fifth aspect provides a computer device including a memory and a processor, the memory storing computer-readable instructions that, when executed by the processor, cause the processor to perform the steps of the data transmission method described above.

[0052] A sixth aspect provides a storage medium storing computer-readable instructions, which, when executed by one or more processors, cause the one or more processors to perform the steps of the data transmission method described above.

[0053] The aforementioned data transmission method, apparatus, computer equipment, and storage medium include two steps: key exchange and data transmission. First, the key exchange process involves preparing the keys required for the data transmission process. Second, the data transmission process involves the client using the keys obtained during the key exchange process to encrypt, sign, decrypt, and verify the transmitted data. Similarly, the server uses the corresponding keys to encrypt, sign, decrypt, and verify the transmitted data. During the key exchange process, the SM2 asymmetric encryption algorithm is used to encrypt the keys, providing security for key transmission. During the data transmission process, the SM4 symmetric encryption algorithm is used to encrypt and decrypt the messages, and SM2 and SM3 are used to sign and verify the messages, ensuring the security and tamper-proof nature of the message transmission. Therefore, this invention employs national cryptographic algorithms, improving algorithm security; the data transmission process uses asymmetric encryption algorithms to encrypt highly secure data such as keys; by adding a signature to the transmitted data, successful data transmission is considered complete only after signature verification, ensuring the uniqueness of data transmission and preventing third-party tampering; the encryption algorithm is easily portable and compatible with multiple platforms, possessing broad applicability. Attached Figure Description

[0054] Figure 1 This is a diagram illustrating the implementation environment of a data transmission method provided in one embodiment.

[0055] Figure 2 Here is a flowchart of a data transmission method in one embodiment;

[0056] Figure 3 Here is another flowchart of the data transmission method in one embodiment;

[0057] Figure 4 This is an interactive flowchart of a data transmission method in one embodiment;

[0058] Figure 5 This is a structural block diagram of a data transmission device in one embodiment;

[0059] Figure 6 This is another structural block diagram of the data transmission device in one embodiment;

[0060] Figure 7 This is a schematic diagram of the structure of a computer device according to an embodiment of the present invention;

[0061] Figure 8 This is another structural schematic diagram of a computer device according to one embodiment of the present invention. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0063] It is understood that the terms "first," "second," etc., used in this application may be used herein to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish one element from another. For example, without departing from the scope of this application, a first data transmission script may be referred to as a second data transmission script, and similarly, a second data transmission script may be referred to as a second data transmission script.

[0064] The data transmission method provided in this embodiment of the invention can be applied to, for example... Figure 1 In this application environment, the client communicates with the server via a network. Applied to the client, the client receives the server's public key returned by the server; generates a first public key and its corresponding first private key using the SM2 national cryptographic algorithm, generates a symmetric key using the SM4 national cryptographic algorithm, and generates a first combination containing the client's user identifier and the first public key; encrypts the first combination with the symmetric key to obtain the first combination encrypted ciphertext; encrypts the symmetric key with the server's public key to obtain the symmetric key encrypted ciphertext; sends the first combination encrypted ciphertext and the symmetric key encrypted ciphertext to the server, so that the server can use the first public key and the symmetric key to encrypt and generate a second combination encrypted ciphertext; receives the second combination encrypted ciphertext returned by the server; and decrypts the second combination encrypted ciphertext to obtain the master key and the second public key. In this invention, the key exchange process requires the use of the SM2 asymmetric encryption algorithm to encrypt the key, providing security for key transmission. During data transmission, the SM4 symmetric encryption algorithm is used to encrypt and decrypt the message, and SM2 and SM3 are used to sign and verify the message to ensure the security and tamper-proof nature of message transmission. The client can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. The server can be implemented using a standalone server or a server cluster consisting of multiple servers. The invention will now be described in detail through specific embodiments.

[0065] Please see Figure 2 As shown, Figure 2 The data transmission method provided in this embodiment of the invention is applied to a client, and the transmission method includes:

[0066] A10. Generate the first public key and its corresponding first private key using the SM2 national cryptographic algorithm, generate the symmetric key using the SM4 national cryptographic algorithm, and generate the first combination containing the client user identifier and the first public key.

[0067] The client generates the first public key pub1 and the first private key pri1 of the SM2 national cryptographic algorithm. These public and private keys are the public and private keys of the asymmetric algorithm SM2, provided by SM2. The client also generates a symmetric key using the SM4 national cryptographic algorithm. This symmetric key is provided by the SM4 national cryptographic algorithm. For example, a 16-byte random number is generated as the key ran1, which is the key used for encryption by the SM4 national cryptographic symmetric encryption algorithm.

[0068] It should be understood that the full name of the SM2 national cryptographic algorithm is SM2 Elliptic Curve Public Key Cryptography, which includes the SM2-1 Elliptic Curve Digital Signature Algorithm, the SM2-2 Elliptic Curve Key Exchange Protocol, and the SM2-3 Elliptic Curve Public Key Encryption Algorithm, used to implement functions such as digital signature key negotiation and data encryption. Comparatively, the SM2 national cryptographic algorithm is based on the discrete logarithm problem of point groups on elliptic curves. Compared to the RA algorithm, the 256-bit SM2 cryptography is already stronger than the 2048-bit RA cryptography.

[0069] The full name of the SM4 national cryptographic algorithm is SM4 block symmetric cipher algorithm, used to perform encryption / decryption operations on data to ensure the confidentiality of data and information. Comparatively, the SM4 national cryptographic algorithm has the same key length and block length of 128 bits as the AES algorithm, therefore it is more secure than the 3DES algorithm.

[0070] The client user identifier is used to identify the client device and is a unique identifier for the client device (such as a POS machine). Examples include the client device's Sn code or QR code. Specifically, the Sn and QR code here refer to POS machine information, not the QR code used for scanning transactions; they are unique identifiers of the machine used to identify a particular machine. The first combination of the client user identifier and the first public key refers to packaging and combining the client identifier and the first public key. The significance of this step is to assemble the machine information. The assembled information is collectively referred to as: the first combination of the client user identifier and the first public key, secretlnfo.

[0071] A20. Encrypt the first combination using a symmetric key to obtain the encrypted ciphertext of the first combination;

[0072] The encryption of the first combination secretlnfo using SM4+ symmetric key ran1 is to encrypt the assembly information of the client user identifier and the first public key, resulting in the first combination encrypted ciphertext SM4secretlnfo.

[0073] In this step, the first public key is encrypted, meaning that the first public key is transmitted to the server in an encrypted manner, ensuring the security of the transmission of the first public key.

[0074] A30. Encrypt the symmetric key with the server's public key to obtain the symmetric key encrypted ciphertext, where the server's public key is the server's public key returned by the server.

[0075] Specifically, the symmetric key ran1 is encrypted using SM2 and the server's public key serverPub to obtain the symmetric key encrypted ciphertext SM2ran1. Here, both the server's public key serverPub and the server's private key serverPri are generated by the server using the SM2 national cryptographic algorithm. The server sends the server's public key serverPub to the client and keeps the server's private key serverPri for itself.

[0076] In this step, the symmetric key is encrypted, meaning that the symmetric key is transmitted to the server in an encrypted manner, ensuring the security of the symmetric key transmission.

[0077] A40. Send the first combination of encrypted ciphertext and symmetric key encrypted ciphertext to the server so that the server can decrypt them to obtain the first public key and symmetric key. Use the first public key to encrypt the second public key to obtain the second public key encrypted ciphertext. Use the symmetric key to encrypt the second public key encrypted ciphertext and the master key to obtain the second combination of encrypted ciphertext.

[0078] In this step, the encrypted first public key and symmetric key are transmitted to the server in an encrypted manner for decryption. The server then uses the first public key and symmetric key to encrypt the data to be transmitted, ensuring the security of data transmission. In this embodiment, the second public key is encrypted with the first public key, and the ciphertext and master key are encrypted with the second public key using the symmetric key. This means that the second public key and master key are transmitted in an encrypted manner, ensuring the security of their transmission.

[0079] A50, Receive the second set of encrypted ciphertext returned by the server;

[0080] A60. Decrypt the second combination of encrypted ciphertext to obtain the master key and the second public key.

[0081] Understandably, the second combination of encrypted ciphertext is encrypted using the SM4 national cryptographic algorithm plus a symmetric key, so the client can decrypt it using the symmetric key. The second public key is encrypted using SM2 plus the first public key, so the client can decrypt it using the first private key, which is a pair with the first private key, to obtain the second public key.

[0082] In some embodiments, A60 may include:

[0083] A601. Decrypt the second combination of encrypted ciphertext using the symmetric key to obtain the encrypted ciphertext encrypted with the master key and the second public key.

[0084] A602. Use the first private key to decrypt the ciphertext encrypted with the second public key to obtain the second public key.

[0085] In some embodiments, after A60, the following may also be included:

[0086] A70. Encrypt the first message to be sent by the client to obtain the encrypted ciphertext of the first message, and sign the first message to obtain the first signed message;

[0087] In this embodiment, after the key exchange between the key client and the server is completed, the exchanged key is used to encrypt and sign the message to be transmitted. Encryption is to ensure that the message will not be leaked during transmission, and signing is to verify that the transmitted message has not been tampered with.

[0088] In some embodiments, A70 may include:

[0089] A701. Determine the first header and first message content of the first message to be sent by the client;

[0090] Understandably, assembling a message refers to the data transmitted in a network request. For example, when making a payment by scanning a QR code, it is necessary to upload information such as the QR code, user information, and transaction amount. This information is collectively referred to as a "message," which results in the header (headStr) and the content (bodyStr).

[0091] A702. Encrypt the content of the first message using the master key to obtain the encrypted ciphertext of the first message;

[0092] The master key msgSecretKey is generated by the server and obtained in A601 by decrypting the second combination of encrypted ciphertext, that is, by using the SM4 national cryptographic algorithm + the master key to encrypt the message content bodyStr to obtain the first message encrypted ciphertext bodyContent.

[0093] A703. Perform a hash calculation on the first header and the first message content to obtain the first hash value;

[0094] Specifically, the first hash value bodyHash is obtained by using the national cryptographic SM3 digest algorithm to combine the first header headStr and the first message content bodyStr.

[0095] A704. Sign the first hash value with the first private key to obtain the first signed message.

[0096] The first signed message, signContent, is obtained by using the first private key pri1 + SM2 national cryptographic algorithm + bodyHash. The SM2 national cryptographic algorithm has its own signature algorithm implementation.

[0097] A80. The first header, the first encrypted ciphertext, and the first signed message are combined to form the first transmission data and sent to the server.

[0098] Understandably, A10 to A60 exchange keys between the client and server in an encrypted manner, thereby enabling the encrypted acquisition of the master key for encrypting messages. A07 and A08 encrypt and sign the messages to be transmitted before sending them to the client, ensuring the security of message data transmission.

[0099] In some embodiments, after A80, the following may also be included:

[0100] The A90 receives the second transmission data returned by the server, decrypts and verifies the signature of the second transmission data; wherein, the second transmission data includes a second header, a second encrypted ciphertext, and a second signed message;

[0101] The second message is data generated by the server in response to the first message sent by the client. To ensure secure data transmission, the server encrypts and signs the second message before transmission. Therefore, the client needs to decrypt and verify the signature after receiving the second transmitted data.

[0102] In some embodiments, A90 may include:

[0103] A901 uses the master key to decrypt the encrypted ciphertext of the second message, thus obtaining the content of the second message;

[0104] The second message is encrypted using the master key generated by the SM4 national cryptographic algorithm, and decryption is also performed using the SM4 national cryptographic algorithm and the master key.

[0105] A902 performs a hash calculation on the second header and the second message content to obtain the second hash value;

[0106] The process involves calculating the hash value of the second message on the server side using the SM3 national cryptographic algorithm, and similarly, on the client side. Specifically, the hash value is calculated using the SM3 algorithm, which includes the second header and its content. Ideally, the hash value calculated by the client should be the same as that calculated by the server. If they differ, it indicates that the second message has been tampered with.

[0107] A903 uses the second public key to verify the second hash value.

[0108] The server uses the SM2 national cryptographic algorithm and a second private key to sign the second hash value. Therefore, the client uses the SM2 national cryptographic algorithm and a second public key to verify the signature. The SM2 national cryptographic algorithm's built-in signature verification algorithm returns either "true" or "false" indicating successful or failed signature verification.

[0109] A100. If the signature verification is successful, the second message from the server is obtained based on the second transmitted data.

[0110] If the signature verification passes, the data reception is successful, and you will receive information about the transmitted file, such as the name of the file to be transmitted. If the signature verification fails, a result indicating that the signature verification failed will be returned.

[0111] Please see Figure 3 As shown, Figure 3 The data transmission method provided in this embodiment of the invention is applied to a client, and the transmission method includes:

[0112] B10. Generate the second public key and its corresponding second private key using the SM2 national cryptographic algorithm, and generate the master key using the SM4 national cryptographic algorithm;

[0113] The server generates a second public key, signPub, and a second private key, pri1, using the SM2 national cryptographic algorithm. These public and private keys are public and private keys for the asymmetric SM2 algorithm. The server also generates a master key, megSecretkey, using the SM4 national cryptographic algorithm. This master key is used to encrypt message data sent by the server.

[0114] B20. Receive the first combination of encrypted ciphertext and symmetric key encrypted ciphertext sent by the client;

[0115] The first encrypted ciphertext is obtained by the client using the SM4 national cryptographic algorithm and the symmetric key ran1 to encrypt the client user identifier and the first public key assembly information; the symmetric encrypted ciphertext is obtained by the client using the SM2 national cryptographic algorithm and the server public key serverPub to encrypt the symmetric key ran1.

[0116] B30. Decrypt the first combination of encrypted ciphertext and symmetric key encrypted ciphertext to obtain the symmetric key and the first public key;

[0117] Understandably, the server and client exchange keys in an encrypted manner to ensure the security of key transmission.

[0118] In some embodiments, B30 may include:

[0119] B301. Use the server's private key to decrypt the symmetric key encrypted ciphertext to obtain the symmetric key;

[0120] B302. Decrypt the first combination of encrypted ciphertext using the symmetric key to obtain the first public key.

[0121] Understandably, based on the client's encryption method, the server sets the corresponding decryption method. First, the symmetric key encrypted ciphertext is decrypted using the SM2 national cryptographic algorithm and the server's private key serverPri to obtain the symmetric key ran1. Then, the first combination of encrypted ciphertext is decrypted using the SM4 national cryptographic algorithm and the symmetric key ran1 to obtain the first public key. Thus, the server completes the task of receiving the first public key pub1 and the symmetric key ran1 generated by the client.

[0122] B40. Encrypt the second public key with the first public key to obtain the ciphertext encrypted with the second public key;

[0123] Specifically, the second public key signPub is encrypted using the SM2 national cryptographic algorithm and the first public key pub1 to obtain the encrypted ciphertext pubKey of the second public key.

[0124] B50. Encrypt the second combination of the second public key and the master key using the symmetric key to obtain the second combination of encrypted ciphertext.

[0125] Specifically, the second public key encrypted ciphertext pubKey and the master key msgSecretKey are packaged together and encrypted using the SM4 algorithm and a symmetric key to obtain the second combined encrypted ciphertext respSecretlnfo.

[0126] B60. Send the second combination of encrypted ciphertext to the client so that the client can decrypt the second combination of encrypted ciphertext to obtain the second public key and the master key.

[0127] This step enables the encrypted transmission of the second public key and the master key to the client. This completes the task of sending the server-generated key to the client.

[0128] In some embodiments, the following may also be included after B60:

[0129] B70. Receive the first transmitted data from the client, and decrypt and verify the first transmitted data.

[0130] It is understandable that the client encrypts and signs the first transmitted data before transmitting it, so the server needs to decrypt and verify the signature after receiving the first transmitted data.

[0131] In some embodiments, B70 may include:

[0132] B701. Use the master key to decrypt the encrypted ciphertext of the first message to obtain the content of the first message;

[0133] The first message is encrypted using a master key generated by the SM4 national cryptographic algorithm, and decryption is also performed using the SM4 national cryptographic algorithm and the master key.

[0134] B702. Perform a hash calculation on the first header and the first message content to obtain the first hash value;

[0135] The process involves calculating the hash value of the first packet using the SM3 national cryptographic algorithm on the client side. In other words, the hash value of the first packet header plus its content is calculated using the SM3 algorithm. Ideally, the hash value calculated by the client should be the same as the hash value calculated by the server. If they are different, it indicates that the first packet has been tampered with.

[0136] B703. Verify the signature of the first hash value using the first public key.

[0137] The client uses the SM2 national cryptographic algorithm and the first private key to sign the first hash value. Therefore, the client uses the SM2 national cryptographic algorithm and the first public key to verify the first hash value.

[0138] B80. If the verification is successful, the client's first message is obtained based on the first transmitted data.

[0139] Understandably, if the signature verification is successful, it means that the data has been successfully received, that is, the server has received the data transmitted by the client.

[0140] B90. Based on the first message, the second message from the server is obtained;

[0141] Understandably, the server processes the first message sent by the client accordingly. The specific processing method can be set according to the actual scenario, which will not be restricted or elaborated here. Then, the server generates a second message (feedback data) to be returned to the client.

[0142] B100: Encrypt and sign the second message to obtain the second transmission data, and send the second transmission data to the client.

[0143] The server uses the same method to encrypt and sign the second message as the client uses to encrypt and sign the first message. Both use the SM4 symmetric encryption algorithm to encrypt and decrypt the message, and SM2 and SM3 to sign and verify the message. The difference lies in the specific keys used.

[0144] In some embodiments, B100 may include:

[0145] B1001. Encrypt the content of the second message using the master key to obtain the encrypted ciphertext of the second message;

[0146] Specifically, the SM4 national cryptographic algorithm and the master key are used to encrypt the message content bodyStr to obtain the second message ciphertext bodyContent.

[0147] B1002. Perform a hash calculation on the second header and the second message content to obtain the second hash value;

[0148] Specifically, the second hash value bodyHash is obtained by using the national cryptographic SM3 digest algorithm to combine the second header headStr and the second message content bodyStr.

[0149] B1003. Sign the second hash value using the second private key to obtain the second signed message.

[0150] The second signed message, signContent, is obtained by using the second private key signpri, the SM2 national cryptographic algorithm, and bodyHash.

[0151] This embodiment completes the key exchange process by encrypting the key during transmission as described above. During the key exchange process, the SM2 asymmetric encryption algorithm is used to encrypt the key, providing security for key transmission.

[0152] As can be seen from the above scheme, the data transmission method of the present invention includes two steps: key exchange between the client and server, and data transmission. First, the key exchange process: the client and server prepare the keys required for the data transmission process, and then encrypt and transmit their respective keys to each other. Second, the data transmission process: the client uses the key obtained in the key exchange process to encrypt, sign, decrypt, and verify the transmitted data. Similarly, the server also uses the corresponding key to encrypt, sign, decrypt, and verify the transmitted data. During the key exchange process, the SM2 asymmetric encryption algorithm is used to encrypt the key, providing security for key transmission. During the data transmission process, the SM4 symmetric encryption algorithm is used to encrypt and decrypt the message, and SM2 and SM3 are used to sign and verify the message to ensure the security and tamper-proof nature of the message transmission. It is evident that this invention employs national cryptographic algorithms, thereby enhancing algorithm security; during data transmission, highly secure data such as keys are encrypted using asymmetric algorithms; by adding a signature to the transmitted data, successful data transmission is considered only upon successful signature verification, ensuring the uniqueness of data transmission and preventing third-party tampering; the encryption algorithm is easily portable and compatible with multiple platform devices, possessing broad applicability.

[0153] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0154] In one embodiment, a data transmission device is provided, which corresponds one-to-one with the data transmission methods described in the above embodiments. For example... Figure 6As shown, the data transmission device is located on the client side and includes a first key module 101, a first encryption module 102, a first sending module 103, a first receiving module 104, and a first decryption module 105. Detailed descriptions of each functional module are as follows:

[0155] The first key module 101 is used to generate a first public key and its corresponding first private key using the SM2 national cryptographic algorithm, generate a symmetric key using the SM4 national cryptographic algorithm, and generate a first combination containing the client user identifier and the first public key.

[0156] The first encryption module 102 is used to encrypt the first combination with a symmetric key to obtain the first combination encrypted ciphertext, and to encrypt the symmetric key with the server public key to obtain the symmetric key encrypted ciphertext, wherein the server public key is the server public key returned by the server.

[0157] The first sending module 103 is used to send the first combined encrypted ciphertext and the symmetric key encrypted ciphertext to the server so that the server can decrypt them to obtain the first public key and the symmetric key, encrypt the second public key with the first public key to obtain the second public key encrypted ciphertext, and encrypt the second public key encrypted ciphertext and the master key with the symmetric key to obtain the second combined encrypted ciphertext.

[0158] The first receiving module 104 is used to receive the second combined encrypted ciphertext returned by the server.

[0159] The first decryption module 105 is used to decrypt the second combination of encrypted ciphertext to obtain the master key and the second public key.

[0160] In one embodiment, a data transmission device is provided, which corresponds one-to-one with the data transmission methods described in the above embodiments. For example... Figure 6 As shown, the data transmission device is located on the server side and includes a second key module 201, a second receiving module 202, a second decryption module 203, a second encryption module 204, and a second sending module 205. Detailed descriptions of each functional module are as follows:

[0161] The second key module 201 is used to generate a second public key and its corresponding second private key using the SM2 national cryptographic algorithm, and to generate a master key using the SM4 national cryptographic algorithm.

[0162] The second receiving module 202 is used to receive the first combined encrypted ciphertext and the symmetric key encrypted ciphertext sent by the client.

[0163] The second decryption module 203 is used to decrypt the first combination of encrypted ciphertext and symmetric key encrypted ciphertext to obtain the symmetric key and the first public key;

[0164] The second encryption module 204 is used to encrypt the second public key with the first public key to obtain the second public key encrypted ciphertext, and to encrypt the second public key encrypted ciphertext and the master key with a symmetric key to obtain the second combination encrypted ciphertext.

[0165] The second sending module 205 is used to send the second combination of encrypted ciphertext to the client so that the client can decrypt the second combination of encrypted ciphertext to obtain the second public key and the master key.

[0166] This invention provides a data transmission device that first obtains a preliminary ranking of candidate questions through semantic matching, and then proposes a scheme to optimize the question answering engine based on entity alignment. By using entity alignment, the ranking of candidate questions is re-ranked, so that more matching candidate questions are selected. This can effectively avoid the generalization ability defects of the model, greatly improve the effect of entity matching, and improve the effect of the question answering engine.

[0167] Specific limitations regarding the data transmission device can be found in the limitations regarding the data transmission method above, and will not be repeated here. Each module in the aforementioned data transmission device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0168] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external clients via a network connection. When the computer program is executed by the processor, it implements the functions or steps of a data transmission method on the server side.

[0169] In one embodiment, a computer device is provided, which may be a client, and its internal structure diagram may be as follows: Figure 8As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it implements the functions or steps of a data transmission method on the client side.

[0170] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps:

[0171] The first public key and its corresponding first private key are generated using the SM2 national cryptographic algorithm, the symmetric key is generated using the SM4 national cryptographic algorithm, and a first combination containing the client user identifier and the first public key is generated.

[0172] The first combination is encrypted using a symmetric key to obtain the encrypted ciphertext of the first combination.

[0173] The symmetric key is encrypted with the server's public key to obtain the symmetric key encrypted ciphertext, where the server's public key is the server's public key returned by the server.

[0174] The first combination of encrypted ciphertext and symmetric key encrypted ciphertext is sent to the server so that the server can decrypt it to obtain the first public key and symmetric key. The first public key is used to encrypt the second public key to obtain the second public key encrypted ciphertext. The symmetric key is used to encrypt the second public key encrypted ciphertext and the master key to obtain the second combination of encrypted ciphertext.

[0175] Receive the second set of encrypted ciphertext returned by the server;

[0176] Decrypt the second combination of encrypted ciphertext to obtain the master key and the second public key.

[0177] The second public key and its corresponding second private key are generated using the SM2 national cryptographic algorithm, and the master key is generated using the SM4 national cryptographic algorithm.

[0178] Receive the first combination of encrypted ciphertext and symmetric key encrypted ciphertext sent by the client;

[0179] Decrypt the first combination of encrypted ciphertext and symmetric key encrypted ciphertext to obtain the symmetric key and the first public key;

[0180] Encrypt the second public key with the first public key to obtain the ciphertext encrypted with the second public key;

[0181] The second combination of the ciphertext encrypted with the second public key and the master key is encrypted with the symmetric key to obtain the second combination of encrypted ciphertext.

[0182] The second set of encrypted ciphertext is sent to the client so that the client can decrypt the second set of encrypted ciphertext to obtain the second public key and the master key.

[0183] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0184] The first public key and its corresponding first private key are generated using the SM2 national cryptographic algorithm, the symmetric key is generated using the SM4 national cryptographic algorithm, and a first combination containing the client user identifier and the first public key is generated.

[0185] The first combination is encrypted using a symmetric key to obtain the encrypted ciphertext of the first combination.

[0186] The symmetric key is encrypted with the server's public key to obtain the symmetric key encrypted ciphertext, where the server's public key is the server's public key returned by the server.

[0187] The first combination of encrypted ciphertext and symmetric key encrypted ciphertext is sent to the server so that the server can decrypt it to obtain the first public key and symmetric key. The first public key is used to encrypt the second public key to obtain the second public key encrypted ciphertext. The symmetric key is used to encrypt the second public key encrypted ciphertext and the master key to obtain the second combination of encrypted ciphertext.

[0188] Receive the second set of encrypted ciphertext returned by the server;

[0189] Decrypt the second combination of encrypted ciphertext to obtain the master key and the second public key.

[0190] The second public key and its corresponding second private key are generated using the SM2 national cryptographic algorithm, and the master key is generated using the SM4 national cryptographic algorithm.

[0191] Receive the first combination of encrypted ciphertext and symmetric key encrypted ciphertext sent by the client;

[0192] Decrypt the first combination of encrypted ciphertext and symmetric key encrypted ciphertext to obtain the symmetric key and the first public key;

[0193] Encrypt the second public key with the first public key to obtain the ciphertext encrypted with the second public key;

[0194] The second combination of the ciphertext encrypted with the second public key and the master key is encrypted with the symmetric key to obtain the second combination of encrypted ciphertext.

[0195] The second set of encrypted ciphertext is sent to the client so that the client can decrypt the second set of encrypted ciphertext to obtain the second public key and the master key.

[0196] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or computer device described above can be referred to the relevant descriptions on the server side and client side in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0197] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This computer program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, optical disk, or read-only memory (ROM), or random access memory (RAM).

[0198] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0199] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A data transmission method, characterized in that, Applied to the client, the transmission method includes: The first public key and its corresponding first private key are generated using the SM2 national cryptographic algorithm, the symmetric key is generated using the SM4 national cryptographic algorithm, and a first combination containing the client user identifier and the first public key is generated. If the client is a POS machine, the client user identifier is the unique identifier of the POS machine used to identify a machine. The client user identifier is the client's Sn code or QR code. The first combination is encrypted with the symmetric key to obtain the encrypted ciphertext of the first combination. The symmetric key is encrypted using the server's public key to obtain symmetric key encrypted ciphertext, wherein the server's public key is the server's public key returned by the server. The first combined encrypted ciphertext and the symmetric key encrypted ciphertext are sent to the server so that the server can decrypt them to obtain the first public key and the symmetric key. The first public key is used to encrypt the second public key to obtain the second public key encrypted ciphertext. The symmetric key is used to encrypt the second public key encrypted ciphertext and the master key to obtain the second combined encrypted ciphertext. Receive the second combined encrypted ciphertext returned by the server; The second combination of encrypted ciphertext is decrypted to obtain the master key and the second public key.

2. The data transmission method as described in claim 1, characterized in that, The step of decrypting the second combined encrypted ciphertext to obtain the master key and the second public key includes: Decrypt the second combined encrypted ciphertext using the symmetric key to obtain the encrypted ciphertext of the master key and the second public key; The second public key is obtained by decrypting the ciphertext encrypted with the second public key using the first private key.

3. The data transmission method as described in claim 1, characterized in that, After decrypting the second combined encrypted ciphertext to obtain the master key and the second public key, the method further includes: The first message to be sent by the client is encrypted to obtain the encrypted ciphertext of the first message, and the first message is signed to obtain the first signed message; The first header, the encrypted ciphertext of the first message, and the first signed message are combined to form the first transmission data and sent to the server.

4. The data transmission method as described in claim 3, characterized in that, After sending the first transmission data, composed of the first header, the first encrypted ciphertext, and the first signed message, to the server, the method further includes: Receive the second transmission data returned by the server; wherein the second transmission data includes a second header, a second encrypted ciphertext, and a second signed message; The second transmitted data is decrypted and verified. If the signature verification is successful, the second message from the server is obtained based on the second transmitted data.

5. A data transmission method, characterized in that, Applied to the server side, the transmission method includes: The second public key and its corresponding second private key are generated using the SM2 national cryptographic algorithm, and the master key is generated using the SM4 national cryptographic algorithm. The system receives a first combination of encrypted ciphertext and symmetric key encrypted ciphertext sent by the client. If the client is a POS machine, the client user identifier is a unique identifier for the POS machine, used to identify a machine. The client user identifier is the client's Sn code or QR code. Decrypt the first combined encrypted ciphertext and the symmetric key encrypted ciphertext to obtain the symmetric key and the first public key; The second public key is encrypted with the first public key to obtain the ciphertext encrypted with the second public key. The second combination of the second public key ciphertext and the master key is encrypted using the symmetric key to obtain the second combination ciphertext. The second combination of encrypted ciphertext is sent to the client so that the client can decrypt the second combination of encrypted ciphertext to obtain the second public key and the master key.

6. The data transmission method as described in claim 5, characterized in that, After sending the second combined encrypted ciphertext to the client, the method further includes: Receive the first transmitted data from the client; The first transmitted data is decrypted and verified. If the verification passes, the first message of the client is obtained based on the first transmitted data; Based on the first message, the second message from the server is obtained; The second message is encrypted and signed to obtain the second transmission data, which is then sent to the client.

7. A data transmission device, characterized in that, Settings on the client side include: The first key module is used to generate a first public key and its corresponding first private key using the SM2 national cryptographic algorithm, generate a symmetric key using the SM4 national cryptographic algorithm, and generate a first combination containing a client user identifier and the first public key. If the client is a POS machine, the client user identifier is a unique identifier of the POS machine used to identify a machine. The client user identifier is the client's Sn code or QR code. The first encryption module is used to encrypt the first combination with the symmetric key to obtain the first combination encrypted ciphertext, and to encrypt the symmetric key with the server public key to obtain the symmetric key encrypted ciphertext, wherein the server public key is the server public key returned by the server. The first sending module is used to send the first combined encrypted ciphertext and the symmetric key encrypted ciphertext to the server, so that the server can decrypt them to obtain the first public key and the symmetric key, encrypt the second public key with the first public key to obtain the second public key encrypted ciphertext, and encrypt the second public key encrypted ciphertext and the master key with the symmetric key to obtain the second combined encrypted ciphertext. The first receiving module is used to receive the second combined encrypted ciphertext returned by the server; The first decryption module is used to decrypt the second combined encrypted ciphertext to obtain the master key and the second public key.

8. A data transmission device, characterized in that, Configured on the server side, including: The second key module is used to generate the second public key and its corresponding second private key using the SM2 national cryptographic algorithm, and to generate the master key using the SM4 national cryptographic algorithm. The second receiving module is used to receive the first combination of encrypted ciphertext and symmetric key encrypted ciphertext sent by the client. If the client is a POS machine, the client user identifier is the unique identifier of the POS machine used to identify a machine. The client user identifier is the client's Sn code or QR code. The second decryption module is used to decrypt the first combined encrypted ciphertext and the symmetric key encrypted ciphertext to obtain the symmetric key and the first public key; The second encryption module is used to encrypt the second public key with the first public key to obtain the second public key encrypted ciphertext, and to encrypt the second public key encrypted ciphertext and the master key with the symmetric key to obtain the second combination encrypted ciphertext; The second sending module is used to send the second combined encrypted ciphertext to the client, so that the client can decrypt the second combined encrypted ciphertext to obtain the second public key and the master key.

9. A computer device comprising a memory and a processor, the memory storing computer-readable instructions which, when executed by the processor, cause the processor to perform the steps of the method as claimed in any one of claims 1 to 6.

10. A storage medium storing computer-readable instructions, which, when executed by one or more processors, cause the one or more processors to perform the steps of the method as claimed in any one of claims 1 to 6.

Images