Data protection method, system, electronic device, medium and product based on symmetric key

Abstract

The present invention discloses a data protection method and system based on symmetric keys, and the method applied to a first network element includes: obtaining channel information, wherein the channel information includes a first count value and a master key; calculating based on the first count value and the master key to obtain a session key; encrypting the transmission data by the session key to obtain a target ciphertext; obtaining the target ciphertext and the first count value as a first message and sending it to a second network element, so that the second network element receives the first message and decrypts it, and performs corresponding operations according to the decrypted data, wherein each time the first message is successfully sent, the preset cycle value is reduced by 1; judging whether the preset cycle value is 0, if it is equal to 0, re-obtaining the channel information, and resetting the preset cycle value to the target value. In order to improve the security of data transmission, it can be applied to the field of data protection based on symmetric keys.

Description

Technical Field

[0001] The present invention relates to the field of data protection based on symmetric keys, and in particular to a data protection method and system based on symmetric keys. Background Art

[0002] At present, symmetric keys are often used for data security protection. However, during long-term use, traditional symmetric keys face the risk of being unable to be updated in time and easily hacked due to repeated use of symmetric keys. Summary of the invention

[0003] In view of this, an embodiment of the present invention provides a data protection method and system based on symmetric keys, so that the symmetric keys can be updated in time and the security of data transmission is improved.

[0004] The first aspect of the present invention provides a data protection method based on symmetric keys, which is applied to a first network element, including: obtaining channel information, wherein the channel information includes a first count value and a master key; calculating a session key based on the first count value and the master key; encrypting the transmission data with the session key to obtain a target ciphertext; obtaining the target ciphertext and the first count value as a first message and sending it to a second network element, so that the second network element receives the first message and decrypts it, and performs corresponding operations according to the decrypted data, wherein each time the first message is successfully sent, the preset period value is reduced by 1; judging whether the preset period value is 0, if it is equal to 0, re-obtaining the channel information, and resetting the preset period value to the target value.

[0005] According to some embodiments of the present invention, after obtaining the target ciphertext and the first count value as the first message and sending it to the second network element, it also includes: adjusting the first count value, adding 1 to the first count value.

[0006] Another aspect of the present invention provides a data protection method based on a symmetric key, which is applied to a second network element, including: receiving a first message sent by a first network element and decrypting it, and performing corresponding operations according to the decrypted data.

[0007] According to some embodiments of the present invention, the receiving and decrypting of a first message sent by a first network element, and performing corresponding operations based on the decrypted data, also includes: receiving a first message sent from the first network element, and calculating a session key based on a master control key and a first count value in the first message; decrypting a target ciphertext in the first message by using the session key, and if the decryption is successful, obtaining a first count value in the first message and comparing it with a second count value, and if they are the same, performing corresponding operations based on the transmission data in the first message, and adding 1 to the second count value.

[0008] According to some embodiments of the present invention, decrypting the target ciphertext in the first message using the session key also includes: if the decryption fails, determining whether the number of failures is greater than a first threshold; if it is less than the first threshold, discarding the first message; if it is greater than or equal to the first threshold, performing a reset operation; or, if it is greater than or equal to the first threshold, receiving the message and performing corresponding operations, wherein the message is sent by the first network element.

[0009] According to some embodiments of the present invention, obtaining the first count value in the first message and comparing it with the second count value also includes: discarding the first message if the first count value is less than the second count value; performing a reset operation if the first count value is greater than or equal to the first count value; or performing a retransmission operation if the first count value is greater than or equal to the first count value.

[0010] Another aspect of the present invention provides a data protection system based on symmetric keys, comprising: a first network element, used to obtain channel information, wherein the channel information includes a first count value and a master key; a session key is calculated based on the first count value and the master key; the transmission data is encrypted by the session key to obtain a target ciphertext; the target ciphertext and the first count value are obtained as a first message and sent to a second network element, so that the second network element receives the first message and decrypts it, and performs corresponding operations according to the decrypted data, wherein each time the first message is successfully sent, the preset period value is reduced by 1; it is determined whether the preset period value is 0, and if it is equal to 0, the channel information is reselected and the preset period value is reset to the target value. A second network element is used to receive the first message sent by the first network element and decrypt it, and perform corresponding operations according to the decrypted data.

[0011] Another aspect of the present invention provides an electronic device, comprising a processor and a memory; the memory is used to store a program; the processor executes the program to implement any of the symmetric key-based data protection methods described above.

[0012] The electronic device according to the embodiment of the present invention has at least the same beneficial effects as the above-mentioned data protection method based on symmetric keys.

[0013] Another aspect of the present invention provides a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement any of the symmetric key-based data protection methods described above.

[0014] The computer-readable storage medium according to the embodiment of the present invention has at least the same beneficial effects as the above-mentioned symmetric key-based data protection method.

[0015] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above method.

[0016] The embodiment of the present invention sets a preset period value in the first network element, and reduces the preset period value by 1 each time the first message is successfully sent to the second network element. When it is reduced to 0, the channel information is reselected and the preset period value is reset, wherein the channel information includes a first count value and a master key. The session key can be obtained by calculation based on the first count value and the master key, thereby updating the session key. This method reduces the risk of the session key being hacked and improves the security of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A first flow chart of a symmetric key-based data protection method provided by an embodiment of the present invention;

[0019] Figure 2 A second flow chart of a symmetric key-based data protection method provided in an embodiment of the present invention;

[0020] Figure 3 A schematic diagram of a symmetric key-based data protection system provided by an embodiment of the present invention;

[0021] Figure 4 is a schematic block diagram of a device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0023] At present, for the use of symmetric keys, a set of symmetric keys is usually frequently used, or the symmetric keys are manually replaced according to the needs of developers. However, using the same set of symmetric keys for a long time will make the symmetric keys easier to be cracked, and manual replacement is undoubtedly time-consuming and labor-intensive. Therefore, this application proposes a data protection method and system based on symmetric keys, so that the symmetric keys can be replaced in time, further ensuring the security of data transmission, and can be widely used in related fields of data protection.

[0024] Figure 1 The first flow chart of the symmetric key-based data protection method provided in an embodiment of the present invention is applied to the first network element 310, including steps S110 to S150:

[0025] Step S110, obtaining channel information, wherein the channel information includes a first count value and a master key.

[0026] Specifically, the first network element 310 includes a terminal and a server, depending on which party performs the sending operation. The first network element 310 selects a channel number to obtain a channel, and the first network element 310 and the second network element 320 interact through the channel, wherein the master key is a symmetric key agreed upon by the first network element 310 and the second network element 320, and the information corresponding to the channel is the channel information, wherein the first count value and the master key contained in different channel information are different, and the first network element 310 obtains the channel information randomly, which further reduces the risk of predicting which channel to select.

[0027] Step S120: Calculate the session key based on the first count value and the master key.

[0028] Specifically, the session key is calculated and generated based on the current first count value and the master key using the AES_CTR algorithm. It should be noted that after sending a message to the second network element 320, the first count value will be increased by 1, and when the first network element 310 continues to transmit data next time, the first count value and the master key must be obtained again to calculate the session key. In other words, each session key is different, thereby further protecting the security of data transmission.

[0029] Step S130, encrypt the transmission data using the session key to obtain the target ciphertext.

[0030] Specifically, the first network element 310 uses the session key to calculate using the AES_GCM algorithm to encrypt and protect the transmission interaction of the current transmission data, thereby obtaining the target ciphertext. It should be noted that the specific content of the transmission data depends on the transmission type, and different transmission types are used to distinguish different messages.

[0031] Step S140, obtain the target ciphertext and the first count value as the first message and send it to the second network element 320, so that the second network element 320 receives the first message and decrypts it, and performs corresponding operations according to the decrypted data, wherein each time the first message is successfully sent, the preset period value is reduced by 1.

[0032] Step S150, determining whether the preset period value is 0, if it is equal to 0, reacquiring the channel information, and resetting the preset period value to the target value.

[0033] Specifically, the first network element 310 concatenates the target ciphertext and the first count value as the first message and sends it to the second network element 320. In addition, the first message may also include a message verification code for verifying the legitimacy of the first network element 310 and the second network element 320. Furthermore, it may also include a transmission type, such as using different data to represent different transmission types. The count value calculation of the message header is specifically as follows: the 10 bits of 0-9 in the message header are the 10 bits of the LSB of the count value. When the server or terminal receives the message, the initial value of the timer is used to intercept the first 22 bits and the 10 bits of the header to concatenate them into a 4-byte count value. When the initial value of the timer is intercepted, pay attention to whether there is a carry. If there is a carry, the padding needs to be calculated.

[0034] After the first network element 310 completes sending the first message, it will update the configuration file, reduce the preset period value by 1, and determine whether the preset period value is equal to 0. If it is equal to 0, it will randomly select a channel number again and then select a channel to obtain channel information, that is, obtain a new first count value and a master key, and calculate a new session key. When the number of times this set of session keys is executed reaches the preset period value, a new set of session keys will be obtained again, thereby completing the update of the session key, making the session key more difficult to be cracked, and improving security. It should be noted that the first network element 310 and the second network element 320 interact through the channel, and the master key is a value agreed upon by both parties. Therefore, when the first network element 310 selects a new channel to obtain new channel information and obtains a new master key, the second network element 320 will also obtain a new agreed master key accordingly. It should be noted that after the channel is reselected, the preset period value will be reset to the target value, that is, a new round of calculation will be restarted to determine how many times the same set of session keys have been interacted. The determination of the target value can be determined based on prior knowledge, and can be a fixed value or a variable value.

[0035] In another embodiment, after the target ciphertext and the first count value are obtained as the first message and sent to the second network element 320, the method further includes: adjusting the first count value by adding 1 to the first count value.

[0036] Specifically, after the first network element 310 completes sending the first message, it will update the configuration file and increase the first count value by 1. When the first network element 310 sends the first message to the second network element 320 in the next round, it will recalculate a new session key based on the first count value and the master key. It can be understood that even if the number of interactions between the first network element 310 and the second network element 320 has not reached the preset period value, the first count value will increase by 1 each time the first message is sent, so a new session key will be recalculated each time, thereby further updating the session key and ensuring the security of data transmission.

[0037] refer to Figure 2 , Figure 2 The second flow chart of the symmetric key-based data protection method provided in the embodiment of the present invention is applied to the second network element 320, and includes the following steps:

[0038] Step S210: receiving and decrypting a first message sent by the first network element 310, and performing corresponding operations according to the decrypted data.

[0039] Specifically, after receiving the first message, the target ciphertext is decrypted to obtain the transmission data therein, and a corresponding operation is performed.

[0040] In another embodiment, after receiving the first message, the target ciphertext is decrypted to obtain the transmission data therein, and the corresponding operation is performed, including the following steps:

[0041] Receiving a first message sent from the first network element 310, and obtaining a session key by calculation based on the master key and a first count value in the first message;

[0042] The target ciphertext in the first message is decrypted using the session key. If the decryption is successful, the first count value in the first message is obtained and compared with the second count value. If they are the same, the corresponding operation is performed according to the transmission data in the first message, and the second count value is increased by 1.

[0043] Specifically, after receiving the first message, the second network element 320 parses it and calculates the session key using the AES_CTR algorithm based on the master key agreed with the first network element 310 and the first count value in the first message. The second network element 320 uses the session key to decrypt the target ciphertext, and further, it can also use the message check code MAC for verification. If the decryption and verification are successful, it means that the message is legal, and continues to compare the first count value in the first message with the second count value in the second network element 320. If they are the same, it means that the first network element 310 successfully transmits data to the second network element 320, and in the previous round, the second network element 320 obtains the operation corresponding to the successfully executed data, and the data transmission and execution are normal. Therefore, it responds to the transmission data obtained after decryption in the first message this time, and performs the corresponding operation based on the content of the transmission data, and adds 1 to the second count value, indicating that this operation is successfully executed.

[0044] Furthermore, when decryption is performed using the session key and verification is performed using the message verification code, if decryption fails or verification fails, the number of failures is obtained, and when the number of failures is less than the first threshold, the first message is discarded, that is, the first network element 310 is waited to resend the first message. If the number of failures is greater than or equal to the first threshold, the second network element 320 will perform a reset operation or receive a message to perform a corresponding operation. Specifically, when the first network element 310 is a terminal and the first network element 310 is a server, the second network element 320 will perform different operations. When the first network element 310 is a terminal and the second network element 320 is a server, the server will perform a reset operation. When the first network element 310 is a server and the second network element 320 is a terminal, the server will perform a reset operation when it cannot receive a response from the terminal for a long time, and the terminal waits for the message sent to the terminal when the server performs the reset operation and performs a corresponding operation according to the content of the message.

[0045] Furthermore, when comparing the first count value with the second count value, if the first count value is less than the second count value, the first message is discarded, and the first network element 310 is waited to send the next first message. Exemplarily, it is assumed that the first network element 310 sends a first message to the second network element 320, and the count value in the first message is A. After the sending is successful, the first count value in the first network element 310 is updated to A+1, and after the second network element 320 receives the first message and performs the corresponding operation, the second count value is updated to A+1. At this time, the first network element 310 has a problem and repeatedly sends the first message containing the first count value A to the second network element 320, but at this time the second count value in the second network element 320 is A+1, which will cause the first count value to be less than the second count value, so the second network element 320 will discard the message this time and wait for the next reception of the first message for re-comparison. If the first count value is greater than the second count value, a reset operation or a retransmission operation will be performed. Specifically, different operations will be triggered based on the first network element 310. If the first network element 310 is a terminal and the second network element 320 is a server, the server will perform a reset operation. When the first network element 310 is a server and the second network element 320 is a terminal, the terminal will perform a retransmission operation.

[0046] It should be noted that, in a specific embodiment, after the specific device corresponding to the second network element 320 performs verification or decryption, or after comparing the first count value with the second count value, the operation performed may be further interacted with the specific device corresponding to the first network element 310. For example, when the first network element 310 is a terminal, the second network element 320 is a server. After the number of decryption or verification failures of the server exceeds the first threshold, it will interact with the terminal. Therefore, for a clearer understanding, the following specific embodiments are explained using the terminal and the server:

[0047] Furthermore, the first message also includes a transmission type. Different transmission types can be distinguished according to different data. Different transmission types correspond to different transmission data. At this time, the first network element 310 and the second network element 320 will perform different operations based on the terminal or the server. The specific operations are as follows:

[0048] (1) Specifically, when the first network element 310 is a terminal and the second network element 320 is a server, the terminal sends a first message to the server. If the transmission type is to send the original message, the terminal directly encrypts the original message through the session key to obtain the target ciphertext, and splices it into the first message and sends it to the server. The server decrypts it through the session key to obtain the original message, and sends it to the corresponding system service for execution based on the original message; if the transmission type is to send a confirmation character, the terminal directly encrypts the confirmation character to obtain the target ciphertext, and assembles it into the first message and sends it to the server. The server decrypts it through the session key to obtain the confirmation character, and stops sending the reset command to the terminal. The confirmation character usually appears when the server needs to perform a reset operation, and will continue to send the reset command to the terminal until the server receives the confirmation character sent by the terminal. Therefore, the confirmation character is used to inform the server that the terminal has completed the corresponding operation; if the transmission type is a resend command, the terminal sends the count value corresponding to the message to be resent to the server.

[0049] Furthermore, if the transmission type is a resend command, the terminal sends the count value corresponding to the message required to be resent to the server, specifically including the following operations:

[0050] Specifically, when the first network element 310 is a server and the second network element 320 is a terminal, the first count value sent by the server is set to be the server downlink count value, and the second count value in the terminal is set to be the terminal downlink count value; when the first network element 310 is a terminal and the second network element 320 is a server, the first count value sent by the terminal is set to be the terminal uplink count value, and the second count value in the server is set to be the server downlink count value.

[0051] When the first network element 310 is a server and the second network element 320 is a terminal, the server sends a message to the terminal, and the terminal obtains the server downlink count value in the message and compares it with the terminal downlink count value. If the terminal determines that the server downlink count value is greater than the terminal downlink count value, the terminal starts to perform a retransmission operation. At this time, it is equivalent to the terminal being the first network element 310, and the transmission type of the data to be transmitted is a retransmission command. Therefore, the terminal uplink count value is obtained. It should be noted that the count value must be added by 1 after the terminal performs the operation. That is to say, in fact, after the terminal performs the operation as the first network element 310 in the previous round, the count value has been added by 1. In this round, the terminal uplink count value and the uplink master control key are calculated to obtain the first session key. The uplink count value used should be the value of the terminal uplink count value in the previous round plus 1. The terminal uses the first session key to encrypt the downlink terminal count value plus 1 as the transmission data to obtain the target ciphertext, and sends it to the server through the first message. At this time, the terminal uplink count value is increased by 1, and the period preset value is reduced by 1. After the server receives the first message, it calculates the first session key according to the master key and the terminal uplink count value in the first message, and decrypts the target ciphertext in the first message with the first session key to obtain the transmission data, that is, the downlink terminal count value. The server uses the downlink terminal count value as the new downlink server count value, and calculates the second session key through the new downlink server count value and the master key. At this time, the server becomes the first network element 310 again, and the terminal is the second network element 320. The server uses the second session key to encrypt the message to be resent as the transmission data to obtain the target ciphertext, and sends it to the terminal through a message. After the terminal receives the target ciphertext, it calculates the second session key through its own terminal downlink count value and the master control key, and decrypts the target ciphertext with the second session key to obtain the resent message.

[0052] The following example illustrates the change in the count value: when the server acts as the first network element 310, it sends a message to the terminal. At this time, the server downlink count value in the message is A2. After the message is sent successfully, the server downlink count value in the server is updated to A2+1. After receiving the message, the terminal compares the server downlink count value and the terminal downlink count value, and finds that the server downlink count value A2 is greater than the terminal downlink count value B2, indicating that when the server sent the message to the terminal in the last round, the terminal did not receive the message or did not execute the message, so that the server downlink count value in the server was +1, while the terminal downlink count value in the terminal did not change, so that the server downlink count value A2 is greater than the terminal downlink count value B2. Therefore, after determining this result, the terminal wants the server to resend the corresponding message in the previous round, that is, the message corresponding to the terminal downlink count value B2 in the current terminal in the server. Therefore, the terminal downlink count value B2 is encrypted as transmission data and sent to the server. After receiving it, the server uses the terminal downlink count value B2 as the new server downlink count value, that is, adjusts the server downlink count value, and uses the command and message corresponding to the server downlink count value as transmission data, which is encrypted and sent to the terminal. The terminal uses the downlink count value B2 and the master control key to obtain the session key to decrypt the ciphertext and obtain the message required to be resent.

[0053] Based on the SCP70 specification, a solution for mutual authentication and data protection between the terminal and the server is implemented. In authentication and data protection, the session key is calculated by the message type, count value and master key, and the session key is used to encrypt and protect data transmission. When the count value reaches a certain number of times, a request will be sent to reset the terminal count value and the new session factor to protect the timely update of the symmetric key.

[0054] (2) Furthermore, when the first network element 310 is a server and the second network element 320 is a terminal, the server sends a first message to the terminal. If the transmission type is to send the original message, the server directly encrypts the original message using the session key to obtain the target ciphertext, and splices it into the first message and sends it to the terminal. The terminal decrypts the message using the session key to obtain the original message, and performs corresponding operations based on the content of the original message. If the transmission type is a confirmation character, the server encrypts the confirmation character as transmission data to obtain the target ciphertext, and sends the target ciphertext to the terminal through the first message. After receiving the target ciphertext, the terminal decrypts the confirmation character and stops sending the message requesting retransmission. If the transmission type is a reset command, the server The server selects a new channel, obtains a new count value and a new master key in the channel, calculates a first key based on the new count value and the old master key in the channel selected last time, encrypts the new master key as transmission data using the first key to obtain a target ciphertext, obtains the target ciphertext, the new count value and the message check code as a first message and sends it to the terminal, the terminal calculates the first key based on the old master key and the new count value in the first message, decrypts the target ciphertext based on the first key to obtain a new master key, calculates the second key based on the new master key and the new count value as a new session key, encrypts the confirmation character as transmission data using the session key to obtain the target ciphertext, and sends the target ciphertext to the server through a message. It can be understood that after receiving the confirmation character, the server stops sending the command requesting a reset to the terminal. Usually, when the first network element 310 is a terminal and the second network element 320 is a server, the first count value of the terminal is greater than the second count value of the server, and the server triggers a reset command and performs a corresponding operation to reset the session key of the terminal. The first time, the terminal reports data normally, and the server also verifies MAC (message check code) and decrypts data normally on the uplink data. However, the server will then compare the first count value of the terminal. If the first count value of the terminal is greater than the second count value of the server, the message will be discarded, and the server will send a reset command to the terminal. When the server receives the uplink data from the terminal later, if it does not receive the terminal's response ACK (confirmation character) to notify the reset success, the server will continue to send reset commands and will skip the verification at this time.

[0055] In another embodiment, the symmetric key based data protection system performs the following steps:

[0056] The first network element acquires channel information, wherein the channel information includes a first count value and a master control key;

[0057] The first network element calculates the session key based on the first count value and the master key;

[0058] The first network element encrypts the transmission data using the session key to obtain a target ciphertext;

[0059] The first network element obtains the target ciphertext and the first count value as a first message and sends it to the second network element, wherein each time the first message is successfully sent, the preset period value is reduced by 1;

[0060] The first network element determines whether the preset period value is 0, and if it is equal to 0, re-acquires the channel information and resets the preset period value to a target value;

[0061] The second network element receives and decrypts the first message sent by the first network element, and performs corresponding operations according to the decrypted data.

[0062] refer to Figure 3 , Figure 3 A schematic diagram of a symmetric key-based data protection system provided in an embodiment of the present invention includes a first network element 310 and a second network element 320:

[0063] The first network element 310 is used to obtain channel information, wherein the channel information includes a first count value and a master key; a session key is calculated based on the first count value and the master key; the transmission data is encrypting the target ciphertext by the session key; the target ciphertext and the first count value are obtained as a first message and sent to the second network element 320, so that the second network element 320 receives the first message and decrypts it, and performs corresponding operations according to the decrypted data, wherein each time the first message is successfully sent, the preset period value is reduced by 1; it is determined whether the preset period value is 0, and if it is equal to 0, the channel information is reselected, and the preset period value is reset to the target value.

[0064] The second network element 320 is used to receive and decrypt the first message sent by the first network element 310, and perform corresponding operations according to the decrypted data.

[0065] Reference Figure 4, this embodiment provides an electronic device, including a processor and a memory coupled to the processor, the memory stores program instructions that can be executed by the processor, and the processor implements the above-mentioned target risk website detection method when executing the program instructions stored in the memory. Among them, the processor can also be called CPU (Centra l Processing Unit). The processor may be an integrated circuit chip with signal processing capabilities. The processor can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor, or the general-purpose processor can also be any conventional processor, etc. The memory can include various components (e.g., machine-readable media), including but not limited to random access memory components, read-only components and any combination thereof. The memory 520 can also include: instructions (e.g., software) (e.g., stored in one or more machine-readable media); the instructions implement the target risk website detection method in the above-mentioned embodiment. The electronic device has the function of carrying and running the software system for target risk website detection provided by the embodiment of the present invention, for example, a personal computer (PC), a mobile phone, a smart phone, a personal digital assistant (PDA), a wearable device, a Pocket PC (PPC), a tablet computer, etc.

[0066] The embodiment of the present invention also discloses a computer program product or a computer program, wherein the computer program product or the computer program includes a computer instruction, and the computer instruction is stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes Figure 1 and Figure 2 The method shown.

[0067] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0068] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified, one or more of the functions and / or features described may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in separate physical devices or software modules. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions, and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0069] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0070] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0071] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0072] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0073] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0074] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0075] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the described embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A data protection method based on symmetric keys, characterized in that: Applied to the first network element, including: Acquire channel information, wherein the channel information includes a first count value and a master key; wherein acquiring the channel information includes: randomly selecting a channel number, and determining a channel and corresponding channel information according to the channel number; wherein the first count value and the master key included in different channel information are different, and the master key is a symmetric key agreed upon by the first network element and the second network element; Calculating based on the first count value and the master key to obtain a session key; Encrypting the transmission data by the session key to obtain the target ciphertext; Obtain the target ciphertext and the first count value as a first message and send the first message to a second network element through a channel determined by a random channel number, so that the second network element receives and decrypts the first message and performs a corresponding operation according to the decrypted data, wherein each time the first message is successfully sent, the preset period value is reduced by 1; When it is determined that the preset period value is 0, a channel number is randomly selected again to select a channel to obtain new channel information, and the preset period value is reset to a target value; the new channel information includes a new first count value and a new master key; Among them, the second network element receives the first message sent by the first network element and decrypts it, and performs corresponding operations according to the decrypted data, and also includes: receiving the first message sent by the first network element, calculating the session key based on the master control key and the first count value in the first message; decrypting the target ciphertext in the first message by using the session key, if the decryption is successful, obtaining the first count value in the first message and comparing it with the second count value, if they are the same, performing corresponding operations according to the transmission data in the first message, and adding 1 to the second count value.

2. According to the symmetric key-based data protection method of claim 1, after obtaining the target ciphertext and the first count value as the first message and sending it to the second network element, it further comprises: The first count value is adjusted by adding 1 to the first count value.

3. A data protection method based on symmetric keys, characterized in that: Applied to the second network element, including: receiving a first message sent by a first network element and decrypting the message, and performing a corresponding operation according to the decrypted data; The receiving and decrypting the first message sent by the first network element, and performing a corresponding operation according to the decrypted data, further includes: Receiving a first message sent from a first network element, and obtaining a session key by calculation based on a master control key and a first count value in the first message; Decrypt the target ciphertext in the first message by using the session key. If the decryption is successful, obtain a first count value in the first message and compare it with a second count value. If they are the same, perform a corresponding operation according to the transmission data in the first message, and increase the second count value by 1; The first network element is used to: obtain channel information, wherein the channel information includes a first count value and a master key; wherein obtaining the channel information includes: randomly selecting a channel number, determining a channel and corresponding channel information according to the channel number; the first count value and the master key contained in different channel information are different, and the master key is a symmetric key agreed upon by the first network element and the second network element; calculating based on the first count value and the master key to obtain a session key; encrypting the transmission data by the session key to obtain a target ciphertext; obtaining the target ciphertext and the first count value as a first message and sending the first message to the second network element through a channel determined by a random channel number, so that the second network element receives the first message and decrypts it, and performs corresponding operations according to the decrypted data, wherein each time the first message is successfully sent, the preset period value is reduced by 1; when it is determined that the preset period value is 0, randomly selecting a channel number and then selecting a channel to obtain new channel information, and resetting the preset period value to a target value; the new channel information includes a new first count value and a new master key.

4. The symmetric key-based data protection method according to claim 3, wherein the decrypting the target ciphertext in the first message by using the session key further comprises: If the decryption fails, determining whether the number of failures is greater than a first threshold, and if less than the first threshold, discarding the first message; If it is greater than or equal to the first threshold, a reset operation is performed; or, If it is greater than or equal to the first threshold, the message is received and a corresponding operation is performed, wherein the message is sent by the first network element.

5. The data protection method based on symmetric keys according to claim 3, wherein the obtaining and comparing the first count value in the first message with the second count value further comprises: If the first count value is less than the second count value, discarding the first message; If the first count value is greater than or equal to the second count value, a reset operation or a retransmission operation is performed.

6. A data protection system based on symmetric keys, characterized in that: include: A first network element, used to obtain channel information, wherein the channel information includes a first count value and a master key; a session key is calculated based on the first count value and the master key; a target ciphertext is obtained by encrypting the transmission data using the session key; the target ciphertext and the first count value are obtained as a first message and sent to a second network element, so that the second network element receives the first message and decrypts it, and performs corresponding operations according to the decrypted data, wherein each time the first message is successfully sent, a preset period value is reduced by 1; it is determined whether the preset period value is 0, and if it is equal to 0, the channel information is reselected, and the preset period value is reset to a target value; wherein the acquisition of the channel information includes: randomly selecting a channel number, and determining the channel and the corresponding channel information according to the channel number; wherein the first count value and the master key contained in different channel information are different, and the master key is a symmetric key agreed upon by the first network element and the second network element; The second network element is used to receive and decrypt the first message sent by the first network element, and perform corresponding operations according to the decrypted data; wherein, the second network element receives and decrypts the first message sent by the first network element, and performs corresponding operations according to the decrypted data, and also includes: receiving the first message sent by the first network element, and calculating the session key based on the master key and the first count value in the first message; decrypting the target ciphertext in the first message by using the session key, if the decryption is successful, obtaining the first count value in the first message and comparing it with the second count value, if the same, performing the corresponding operation according to the transmission data in the first message, and adding 1 to the second count value.

7. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The storage medium stores a program, and the program is executed by a processor to implement the method according to any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images