Data transmission method, device and storage medium

Abstract

An embodiment of the present invention provides a data transmission method, device and storage medium. The method is executed by a certificate system, including: receiving a certificate acquisition request sent by an edge node; wherein the certificate acquisition request at least includes authentication information for authenticating the edge node; according to the certificate acquisition request, obtaining certificate issuer information from determined certificate information; using the certificate issuer information as an encryption salt value, encrypting the certificate information through an encryption algorithm based on password encryption PBE to generate first encryption information; encrypting the encryption salt value to generate an encrypted encryption salt value; generating first data of a preset length according to the encrypted encryption salt value; and sending the first data and the first encryption information to the edge node.

Description

Technical Field

[0001] The present invention relates to the field of computer application technology, and in particular to a data transmission method, device and storage medium. Background Art

[0002] In the prior art, certificates uploaded by users and pulled by edge nodes are transmitted in plain text, or encryption tools are used to generate encrypted packages for certificates uploaded by users. When users upload certificates in plain text or edge nodes pull certificates in plain text transmission, it is easy to cause the transmission information to be stolen or tampered with, and the security of information transmission cannot be guaranteed; static or single encryption algorithms are easy to be identified and cracked, and the security factor is low; if a dynamic encryption algorithm is used, the randomly generated encryption key needs to be synchronized to the edge node for decryption by the edge node, and the security of key transmission cannot be guaranteed in this process. Summary of the invention

[0003] Embodiments of the present invention provide a data transmission method, device and storage medium.

[0004] The technical solution of the embodiment of the present invention is implemented as follows:

[0005] An embodiment of the present invention provides a data transmission method, which is applied to a certificate system. The method includes:

[0006] Receiving a certificate acquisition request sent by an edge node; wherein the certificate acquisition request at least includes authentication information for performing authority authentication on the edge node;

[0007] According to the certificate acquisition request, obtaining certificate issuer information from the determined certificate information;

[0008] Using the certificate issuer information as an encryption salt value, encrypting the certificate information by using an encryption algorithm based on password encryption PBE to generate first encrypted information;

[0009] Encrypting the encryption salt value to generate an encrypted encryption salt value;

[0010] Generate first data of a preset length according to the encrypted encryption salt value;

[0011] The first data, the encrypted encryption salt value and the first encryption information are sent to an edge node.

[0012] In the above solution, encrypting the encryption salt value to generate the encrypted encryption salt value includes:

[0013] generating a first shared key;

[0014] Sending the first shared key to the edge node; wherein the first shared key is used by the edge node to decrypt the encrypted encryption salt value to determine the encryption salt value;

[0015] The encrypted salt value is encrypted according to the first shared key to generate an encrypted encrypted salt value.

[0016] In the above solution, generating first data of a preset length according to the encrypted encryption salt value includes:

[0017] Determine the preset string length;

[0018] According to the preset character string length, the encrypted salt value is converted into a binary system to generate first data having the same length as the preset character string.

[0019] In the above scheme, the method further comprises:

[0020] generating a second shared key;

[0021] Sending the second shared key to the edge node; wherein the second shared key is used by the edge node to generate authentication information;

[0022] Decrypting the authentication information by using the second shared key to verify the authority of the edge node;

[0023] After the authority verification of the edge node is passed, the first data, the encrypted encryption salt value and the first encryption information are sent to the edge node.

[0024] An embodiment of the present invention also provides another data transmission method, which is applied to an edge node. The method includes:

[0025] Generate authentication information;

[0026] Sending a certificate acquisition request including the authentication information to a certificate system;

[0027] Receiving first data, an encrypted encryption salt value, and first encryption information sent by the certificate system according to the certificate acquisition request;

[0028] The first encrypted information is decrypted according to the first data and the encrypted salt value to determine the certificate information.

[0029] In the above scheme, generating authentication information includes:

[0030] Generate secure random numbers;

[0031] Receiving a second shared key sent by the certificate system;

[0032] According to the received second shared key, encrypt the secure random number by using a key-related hash operation message authentication code HMAC encryption algorithm to generate second encrypted information;

[0033] Authentication information is generated according to the second encrypted information.

[0034] In the above solution, generating authentication information according to the second encrypted information includes:

[0035] Obtain the uniform resource identifier URI of the interface, the interface message body, and the initiation timestamp of the certificate acquisition request;

[0036] According to the second encrypted information, encrypt the uniform resource identifier URI of the interface, the interface message body and the initiation timestamp of the certificate acquisition request by using the HMAC encryption algorithm to generate third encrypted information;

[0037] Authentication information is generated according to the third encrypted information, the initiation timestamp of the certificate acquisition request and the secure random number.

[0038] In the above solution, the first encrypted information is decrypted according to the first data and the encrypted salt value to determine the certificate information, including:

[0039] Determining an encrypted salt value according to the first data and a preset character string length determined by the certificate system;

[0040] Receiving a first shared key sent by the certificate system;

[0041] Decrypting the encrypted salt value according to the first shared key to determine the salt value;

[0042] The first encrypted information is decrypted according to the encryption salt value to determine the certificate information.

[0043] The embodiment of the present invention further provides a data transmission device, which is applied to a certificate system, and comprises: a first receiving module, an acquisition module, a first encryption module, a second encryption module, a generation module and a first sending module;

[0044] The first receiving module is used to receive a certificate acquisition request sent by an edge node; wherein the certificate acquisition request at least includes authentication information for performing authority authentication on the edge node;

[0045] The acquisition module is used to acquire the certificate issuer information from the determined certificate information according to the certificate acquisition request;

[0046] The first encryption module is used to use the certificate issuer information as an encryption salt value, encrypt the certificate information through an encryption algorithm based on password encryption PBE, and generate first encrypted information;

[0047] The second encryption module is used to encrypt the encryption salt value to generate an encrypted encryption salt value;

[0048] The generating module is used to generate first data of a preset length according to the encrypted encryption salt value;

[0049] The first sending module is used to send the first data, the encrypted encryption salt value and the first encryption information to the edge node.

[0050] The embodiment of the present invention also provides another data transmission device, which is applied to an edge node and includes: a generation module, a second sending module, a receiving module and a decryption module;

[0051] The generating module is used to generate authentication information;

[0052] The second sending module is used to send a certificate acquisition request including the authentication information to the certificate system;

[0053] The receiving module is used to receive the first data, the encrypted encryption salt value and the first encryption information sent by the certificate system according to the certificate acquisition request;

[0054] The decryption module is used to decrypt the first encrypted information according to the first data and the encrypted salt value to determine the certificate information.

[0055] An embodiment of the present invention further provides a data transmission device, the device comprising: a processor and a memory for storing a computer program that can be run on the processor;

[0056] Wherein, the processor is used to execute the steps of any one of the above-mentioned data transmission methods when running the computer program.

[0057] An embodiment of the present invention further provides a computer storage medium, characterized in that the computer storage medium stores computer executable instructions; after the computer executable instructions are executed by a processor, the steps of the above-mentioned data transmission method can be implemented.

[0058] In this embodiment, a certificate acquisition request containing authentication information is received from an edge node, and the edge node requesting the certificate is authenticated by the authentication information to prevent the message information from being tampered with, thereby ensuring the security of the data transmission process; the certificate issuer information is used as an encryption salt value, and the certificate information is encrypted by an encryption algorithm based on password encryption PBE to generate first encrypted information, and a variable ciphertext is generated by the PBE encryption algorithm, and the sender information is dynamically extracted from the certificate information as the encryption salt value, and the encryption salt value is encrypted again, and multiple encryption algorithms are mixed to increase the complexity of certificate encryption, increase the cost of cracking the certificate content, and improve the security of certificate transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0060] Figure 1 A schematic diagram of a flow chart of a data transmission method provided by the present invention;

[0061] Figure 2 A schematic diagram of the interaction during the certificate upload and acquisition process provided by an embodiment of the present invention;

[0062] Figure 3 A schematic diagram of a flow chart of another data transmission method provided by the present invention;

[0063] Figure 4 A schematic diagram of the structure of a data transmission device provided by an embodiment of the present invention;

[0064] Figure 5 A schematic diagram of the structure of another data transmission device provided by an embodiment of the present invention;

[0065] Figure 6 A schematic diagram of the structure of another data transmission device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present invention. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present invention.

[0067] In the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other arbitrarily. The steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions. Moreover, although a logical order is shown in the flowchart, in some cases, the steps shown or described can be performed in an order different from that here.

[0068] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present invention belongs. The terms used herein are only for the purpose of describing the embodiments of the present invention and are not intended to limit the present invention.

[0069] Before further describing the embodiments of the present invention in detail, the nouns and terms in communication involved in the embodiments of the present invention are described.

[0070] The embodiment of the present invention provides a data transmission method. Figure 1 A flow chart of a data transmission method provided by the present invention; Figure 1 As shown, the method is applied to a certificate system, comprising:

[0071] Step S101: receiving a certificate acquisition request sent by an edge node; wherein the certificate acquisition request at least includes authentication information for performing authority authentication on the edge node;

[0072] Step S102: acquiring certificate issuer information from the determined certificate information according to the certificate acquisition request;

[0073] Step S103: using the certificate issuer information as an encryption salt value, encrypting the certificate information through an encryption algorithm based on password encryption PBE to generate first encrypted information;

[0074] Step S104: encrypting the encryption salt value to generate an encrypted encryption salt value;

[0075] Step S105: generating first data of a preset length according to the encrypted encryption salt value;

[0076] Step S106: Send the first data, the encrypted encryption salt value and the first encryption information to an edge node.

[0077] Specifically, in step S101, the authentication information is used by the certificate system to authenticate the edge node; if the authentication information is authenticated successfully, it indicates that the current edge node has the authority to obtain the certificate; if the authentication information is not authenticated successfully, it indicates that the current edge node does not have the authority to obtain the certificate.

[0078] It should be noted that the authentication information at least includes: the initiation timestamp of the certificate acquisition request; the certificate system obtains the request time difference by subtracting the initiation timestamp of the certificate acquisition request from the local time, and when the time difference does not exceed the preset time, it indicates that the current certificate acquisition request is valid. If the current time difference exceeds the preset time, it indicates that the current certificate acquisition request is invalid, and an invalidation prompt message is sent to the edge node, and the invalidation prompt message is used to prompt the edge node to re-initiate the certificate acquisition request; in this way, the possibility of certificate information leakage caused by interception or tampering of message information can be reduced, and security in the data transmission process can be provided.

[0079] In step S102, the certificate issuer information may be the name of the certificate authentication center that issued the certificate, or may be a certificate serial number, etc. Here, the certificate issuer information is represented by A.

[0080] The PBE algorithm is a password-based encryption algorithm. Its characteristic is that it uses a password instead of a key. The password is controlled by the user himself, and uses random number hashing and multiple encryption methods to ensure data security. In the encryption process, the PBE algorithm generates an encryption key, namely the encryption salt value, from the password. After the encryption salt value is generated, the PBE algorithm uses a symmetric encryption algorithm to encrypt the data. The symmetric encryption algorithm here can be DES, 3DES, RC5, etc.

[0081] In the above step S103, the certificate information is represented by M; specifically, in this embodiment, DES is used as the symmetric encryption algorithm, the certificate issuer information A is used as the encryption salt value, and the certificate information M is encrypted by an encryption algorithm based on password encryption to generate the first encrypted information S1; wherein, S1 = PBEWithMD5AndDES(M,A).

[0082] Further, in the above step S104, the encryption of the encrypted salt value to generate an encrypted encrypted salt value includes: generating a first shared key; sending the first shared key to the edge node; wherein the first shared key is used by the edge node to decrypt the encrypted encrypted salt value to determine the encrypted salt value; and encrypting the encrypted salt value according to the first shared key to generate an encrypted encrypted salt value.

[0083] Specifically, the first shared key is a first key preset in the communication interface between the certificate system and the edge node. The certificate system and the edge node share the first shared key, and the first shared key is represented by K1.

[0084] Specifically, the certificate system communication interface generates a first shared key K1, and uses the first shared key K1 to perform a symmetric encryption algorithm on the encrypted salt value A to encrypt it, generating an encrypted encrypted salt value A1, A1=DES(A,K1); here, based on the symmetric encryption algorithm, the same key is used for encryption and decryption, namely, the first shared key K1; the edge node obtains the first shared key K1 through the communication interface of the certificate system, and decrypts the encrypted encrypted salt value A1 through the first shared key K1 to determine the encrypted salt value A.

[0085] Further, in the above step S105, generating first data of a preset length according to the encrypted salt value includes: determining a preset string length; and performing base conversion on the encrypted salt value according to the preset string length to generate first data having the same length as the preset string.

[0086] Specifically, in one embodiment, the base conversion may be a hexadecimal conversion; in another embodiment, the base conversion may be an octal conversion or a binary conversion; here, the base conversion may be customized by the system or set by the user terminal.

[0087] Specifically, in this embodiment, the preset string length is determined to be 8 bits, and the encrypted salt value A1 is converted into hexadecimal. Here, A1 represented in hexadecimal form is marked as A2; the string length of A2 is determined. If the string length of A2 is less than the preset string length of 8, 0 is added to the front of A2 until the string length of A2 reaches 8 bits, and the string with a string length of 8 is called the first data and marked as D; if the string length of A2 is greater than or equal to the preset string length of 8, A2 is directly used as the first data D;

[0088] For example: if A2=A01B, and the string length of A2 is less than the preset string length of 8, 0 is added in front of A2 to generate the first data D=0000A01B with a string length of 8 bits; if A2=A000100B, and the string length of A2 is equal to the preset string length of 8, the first data D=A2=A000100B.

[0089] It should be noted that, in this embodiment, a certificate acquisition request containing authentication information sent by an edge node is received, and the edge node requesting the certificate is authenticated through the authentication information to prevent the message information from being tampered with, thereby ensuring the security of the data transmission process; the certificate issuer information is used as the encryption salt value, and the certificate information is encrypted through an encryption algorithm based on password encryption PBE to generate first encrypted information, and a variable ciphertext is generated through the PBE encryption algorithm, and the sender information is dynamically extracted from the certificate information as the encryption salt value, and then the encryption salt value is encrypted, and multiple encryption algorithms are mixed to increase the complexity of certificate encryption, increase the cost of cracking the certificate content, and improve the security of certificate transmission.

[0090] Furthermore, the method also includes: generating a second shared key; sending the second shared key to an edge node; wherein the second shared key is used by the edge node to generate authentication information; decrypting the authentication information by means of the second shared key to perform authority verification on the edge node; after the authority verification on the edge node is passed, sending the first data, the encrypted encryption salt value and the first encrypted information to the edge node.

[0091] Specifically, the second shared key is another key preset in the communication interface between the certificate system and the edge node. The certificate system and the edge node share the second shared key, and the second shared key is represented by K2.

[0092] Specifically, the certificate system communication interface generates a second shared key K2, which is used for the edge node to generate authentication information through the second shared key K2, and includes the authentication information in the certificate acquisition request sent by the edge node; wherein, the edge node obtains the second shared key K2 through the communication interface of the certificate system; the authentication information includes: a secure random number and an initiation timestamp Timestamp of the certificate acquisition request and third encryption information; the certificate system verifies the authority of the edge node based on the authentication information and the second shared key K2; when it is determined that the edge node has the authority to obtain the certificate, it indicates that the authority verification is passed, and the first data D, the encrypted encryption salt value A1 and the first encryption information S1 are sent to the edge node.

[0093] It should be noted that, here, the certificate system authenticates the edge node requesting the certificate through the authentication information in the certificate acquisition request, thereby preventing the message information from being tampered with and ensuring the security of the data transmission process.

[0094] Before step S101, the method further includes the steps of the terminal requesting the certificate system to generate a certificate, and uploading the generated certificate to the certificate system, wherein: Figure 2 A schematic diagram of the interaction during the certificate upload and acquisition process provided by an embodiment of the present invention;

[0095] Step 1: Upload the certificate on the terminal.

[0096] S1: The terminal randomly generates an identity ID and sends the identity ID to the certificate system;

[0097] The identity ID may be an identification code composed of letters, numbers and / or symbols randomly generated by the user terminal, or may be the International Mobile Equipment Identity IMEI or IMSI of the terminal device.

[0098] S2: The certificate system receives the identity ID sent by the terminal, and generates a public key and a private key according to the identity ID;

[0099] S3: The certificate system performs HEX encoding on the modulus and exponent of the public key to generate a terminal public key, and returns it to the terminal;

[0100] S4: The certificate system stores the public key and private key corresponding to the identity ID;

[0101] S4.1: The certificate system performs Base64 encoding on the public key and private key to generate a system public key and a system private key;

[0102] S4.2: storing the system public key, the system private key and the identity ID in a database;

[0103] S4.3: The certificate system sets the validity period of the stored identity ID;

[0104] If the duration of storing the identity ID exceeds the valid duration, execute step 1; if the duration of storing the identity ID does not exceed the valid duration, execute step 5.

[0105] S5: The terminal encrypts the certificate information in sections according to the terminal public key received in step 4, where the encryption method is asymmetric encryption; and uploads the generated encrypted certificate information and the identity ID corresponding to the terminal to the certificate system.

[0106] Step 2: The certificate system obtains the certificate.

[0107] S6: The certificate system reads the corresponding system private key from the database according to the received encrypted certificate information and identity ID, decrypts the encrypted certificate information by using the system private key, and obtains the correct certificate information.

[0108] It should be noted that in the process of uploading the certificate, a dynamic asymmetric encryption method is adopted. The public key does not need to transmit the keys of both parties like symmetric encryption, which greatly improves security. At the same time, both the public key and the private key are randomly generated according to the terminal identity ID. On the basis of setting an expiration time for the identity ID, the identity ID corresponding to the terminal is updated regularly, and then the public key and private key corresponding to the identity ID are updated to prevent the public key and private key from being cracked and causing the leakage of certificate information.

[0109] An embodiment of the present invention provides a data transmission method applied to an edge node. Figure 3 A flow chart of another data transmission method provided by the present invention; Figure 3 As shown, the method includes:

[0110] Step S301: Generate authentication information;

[0111] Step S302: Sending a certificate acquisition request including the authentication information to a certificate system;

[0112] Step S303: receiving the first data, the encrypted encryption salt value and the first encryption information sent by the certificate system according to the certificate acquisition request;

[0113] Step S304: decrypt the first encrypted information according to the first data and the encrypted salt value to determine the certificate information.

[0114] In the above step S301, the generation of authentication information includes: generating a secure random number; receiving a second shared key sent by the certificate system; according to the received second shared key, encrypting the secure random number by a key-related hash operation message authentication code HMAC encryption algorithm to generate second encrypted information; and generating authentication information according to the second encrypted information.

[0115] Specifically, in this embodiment, the second encryption information is represented by S2, and the authentication information is represented by Authorization; the secure random number can be a hexadecimal string with a string size less than or equal to 16 bits, and the secure random number is represented by N1 here.

[0116] The second shared key is a second key preset in the communication interface between the certificate system and the edge node. The certificate system and the edge node share the second shared key, which is represented by K2.

[0117] It should be noted that the message authentication code algorithm (MAC) is a keyed hash function algorithm. A message authentication code based on a hash function requires an encrypted hash function (denoted as H, which can be MD5 or SHA-1) and a key K to calculate the message authentication code. The message authentication code algorithm is compatible with the characteristics of the MD and SHA algorithms, and adds a key on this basis. Therefore, the MAC algorithm is often called the HMAC algorithm.

[0118] Specifically, in this embodiment, the edge node receives the second shared key K2 sent by the certificate system through the communication interface of the certificate system, and the edge node uses the second shared key K2 as the key of the key-related hash operation message authentication code HMAC encryption algorithm to encrypt the secure random number N1 to generate second encrypted information S2, S2 = HMAC_SHA256 (N1, K2); based on the second encrypted information S2, the authentication information Authorization is generated.

[0119] Furthermore, generating authentication information based on the second encrypted information includes: obtaining the uniform resource identifier URI of the interface, the interface message body, and the initiation timestamp of the certificate acquisition request; encrypting the uniform resource identifier URI of the interface, the interface message body, and the initiation timestamp of the certificate acquisition request through the HMAC encryption algorithm according to the second encrypted information to generate third encrypted information; generating authentication information according to the third encrypted information, the initiation timestamp of the certificate acquisition request and the secure random number.

[0120] Specifically, the initiation timestamp of the certificate acquisition request is represented by Timestamp; the second encrypted information is used as an encryption key to encrypt the uniform resource identifier URI of the interface, the interface message body and the initiation timestamp Timestamp of the certificate acquisition request through the HMAC encryption algorithm.

[0121] Specifically, obtain the uniform resource identifier URI of the interface, the interface message body, and the initiation timestamp Timestamp of the certificate acquisition request; use the second encrypted information S2 as the encryption key, encrypt the uniform resource identifier URI of the interface, the interface message body and the initiation timestamp Timestamp of the certificate acquisition request through the HMAC encryption algorithm, and generate the third encrypted information S3; wherein, S3 = HMAC_SHA256 (URI + Timestamp + body, S2); authentication information Authorization = N1 | Timestamp | S3.

[0122] Specifically, in step S303, after the certificate system verifies the authentication information Authorization in the certificate acquisition request sent by the edge node, it is determined that the edge node has the authority to obtain the certificate; the edge node receives the first data D, the encrypted encryption salt value A1 and the first encryption information S1 sent by the certificate system according to the certificate acquisition request.

[0123] Further, in the above step S304, the first encrypted information is decrypted according to the first data and the encrypted salt value to determine the certificate information, including: determining the encrypted salt value according to the first data and a preset string length determined by the certificate system; receiving a first shared key sent by the certificate system; decrypting the encrypted salt value according to the first shared key to determine the salt value; decrypting the first encrypted information according to the salt value to determine the certificate information.

[0124] Specifically, the first shared key is a first key preset in a communication interface between the certificate system and the edge node, and the edge node obtains the first shared key K1 through the communication interface.

[0125] Specifically, determine the string length of the first data D. When the string length of the first data is greater than the preset string length, directly convert the first data D into ASCII code to determine the encrypted encryption salt value A1; when the string length of the first data D is equal to the preset string length, simplify the first data D and convert it into ASCII code to determine the encrypted encryption salt value A1; decrypt the encrypted encryption salt value A1 according to the obtained first shared key K1 to determine the encryption salt value A; use the encryption salt value A as the key to decrypt the first encrypted information S1 to obtain the certificate information M.

[0126] It should be noted that in this embodiment, a certificate acquisition request containing authentication information is sent to the certificate system. The edge node can obtain the first data, the encrypted encryption salt value and the first encryption information only after the certificate system performs authority authentication based on the authentication information, thereby preventing the message information from being tampered with and ensuring the security of the data transmission process.

[0127] The data transmission method according to the embodiment of the present invention is described below with a specific example.

[0128] Step A: The terminal uploads the certificate.

[0129] Step 1: The terminal randomly generates an identity ID and sends the identity ID to the certificate system;

[0130] Step 2: The certificate system receives the identity ID sent by the terminal and generates a public key and a private key according to the identity ID;

[0131] Step 3: The certificate system performs HEX encoding on the modulus and exponent of the public key to generate a terminal public key, and returns it to the terminal;

[0132] Step 4: The certificate system stores the public key and private key corresponding to the identity ID;

[0133] Step 4.1: The certificate system performs Base64 encoding on the public key and private key to generate the system public key and system private key;

[0134] Step 4.2: Store the system public key, the system private key and the identity ID into a database;

[0135] Step 4.3: The certificate system sets the validity period of the stored identity ID;

[0136] If the duration of storing the identity ID exceeds the valid duration, execute step 1; if the duration of storing the identity ID does not exceed the valid duration, execute step 5.

[0137] Step 5: The terminal encrypts the certificate information in sections according to the terminal public key received in step 4, where the encryption method is asymmetric encryption; and uploads the generated encrypted certificate information and the identity ID corresponding to the terminal to the certificate system.

[0138] Step B: The certificate system obtains the certificate.

[0139] Step 6: The certificate system reads the corresponding system private key from the database according to the received encrypted certificate information and identity ID, decrypts the encrypted certificate information with the system private key, and obtains the correct certificate information.

[0140] Step C: The edge node sends a certificate acquisition request to the certificate system.

[0141] Step 7: The edge node generates authentication information and sends a certificate acquisition request including the authentication information to the certificate system;

[0142] Step 7.1: Get the interface uniform resource identifier URI, the interface message body, and the initiation timestamp of the certificate acquisition request, and generate a secure random number N1;

[0143] Here, the string size of the secure random number N1 is less than 16 bits, and its format is an uppercase hexadecimal string; the initiation timestamp Timestamp of the certificate acquisition request is also in an uppercase hexadecimal string format.

[0144] Step 7.2: Encrypt the secure random number N1;

[0145] The second shared key K2 is obtained through the communication interface of the certificate system, and the second shared key K2 is used as the key of the key-related hash operation message authentication code HMAC encryption algorithm to encrypt the secure random number N1 to generate the second encrypted information S2, S2 = HMAC_SHA256 (N1, K2).

[0146] Step 7.3: Generate authentication information based on the second encrypted information;

[0147] The second encrypted information S2 is used as the encryption key, and the uniform resource identifier URI of the interface, the interface message body and the initiation timestamp Timestamp of the certificate acquisition request are encrypted through the HMAC encryption algorithm to generate the third encrypted information S3; wherein, S3 = HMAC_SHA256 (URI + Timestamp + body, S2); authentication information Authorization = N1 | Timestamp | S3.

[0148] Step 7.4: Send a certificate acquisition request including the authentication information to the certificate system.

[0149] Step D: The certificate system sends certificate information to the edge node.

[0150] Step 8: Receive and verify the certificate acquisition request containing authentication information sent by the edge node;

[0151] Step 8.1: The certificate system obtains the secure random number N1, the initiation timestamp of the certificate acquisition request, and the third encrypted information S3 according to the authentication information;

[0152] Step 8.2: Subtract the initiation timestamp of the certificate acquisition request from the local time to obtain the request time difference. When the time difference does not exceed the preset time, it indicates that the current certificate acquisition request is valid, and step Step 8.3 is executed; if the current time difference exceeds the preset time, it indicates that the current certificate acquisition request is invalid. The edge node re-initiates the certificate acquisition request according to the invalidation reminder returned by the certificate system, that is, executes step C.

[0153] Step 8.3: Obtain a second shared key K2, use the second shared key K2 as the key of the key-related hash operation message authentication code HMAC encryption algorithm, encrypt the secure random number N1, and generate a second encrypted information S2, S2 = HMAC_SHA256 (N1, K2);

[0154] Step 8.4: Use the second encrypted information S2 as a key to decrypt the third encrypted information S3 to obtain the interface uniform resource identifier URI', the interface message body' and the initiation timestamp Timestamp' of the certificate acquisition request in the current certificate acquisition request;

[0155] Step8.5: Compare the obtained initiation timestamp Timestamp' of the certificate acquisition request with the initiation timestamp Timestamp of the certificate acquisition request in the authentication information. At the same time, the certificate system performs authority authentication on the edge node according to the uniform resource identifier URI' of the interface in the current certificate acquisition request. If the authority authentication passes, it indicates that the current edge node has the authority to obtain the certificate and executes step Step9; if the authority authentication fails, it indicates that the current edge node does not have the authority to obtain the certificate and executes step Step10.

[0156] Step 9: according to the certificate acquisition request sent by the edge node, send the certificate information corresponding to the certificate acquisition request to the edge node;

[0157] Step 9.1: According to the certificate acquisition request, obtain the certificate issuer information A from the determined certificate information M;

[0158] Step 9.2: Using the certificate issuer information A as the encryption salt value, using DES as the symmetric encryption algorithm, encrypting the certificate information M through the encryption algorithm based on password encryption PBE, and generating the first encrypted information S1; wherein S1 = PBEWithMD5AndDES(M,A);

[0159] Step 9.3: Encrypt the encryption salt value to generate an encrypted encryption salt value;

[0160] Specifically, the communication interface generates a first shared key K1, and uses the first shared key K1 to perform a symmetric encryption algorithm on the encryption salt value A to encrypt the encryption salt value A1, where A1=DES(A, K1);

[0161] Here, the first shared key is a first key preset in the communication interface between the certificate system and the edge node, and the certificate system and the edge node share the first shared key.

[0162] Step 9.4: Generate first data D of a preset length according to the encrypted salt value;

[0163] Specifically, determine that the preset string length is 8 bits, convert the encrypted salt value A1 into hexadecimal, here, A1 represented in hexadecimal form is marked as A2; determine the string length of A2, if the string length of A2 is less than the preset string length of 8, add 0 in front of A2 until the string length of A2 reaches 8 bits, and call the string with a string length of 8 the first data and mark it as D; if the string length of A2 is greater than or equal to the preset string length of 8, directly use A2 as the first data D.

[0164] Step 9.5: Send the first data D, the encrypted salt value A1 and the first encryption information S1 to the edge node;

[0165] Step 10: Returns information indicating that the user is not authorized to obtain the certificate.

[0166] Step E: The edge node receives the first data D, the encrypted salt value A1 and the first encryption information S1 sent by the certificate system, and determines the certificate information M.

[0167] Specifically, determine the string length of the first data D. When the string length of the first data is greater than the preset string length, directly convert the first data D into ASCII code to determine the encrypted encryption salt value A1; when the string length of the first data D is equal to the preset string length, simplify the first data D and convert it into ASCII code to determine the encrypted encryption salt value A1; decrypt the encrypted encryption salt value A1 according to the obtained first shared key K1 to determine the encryption salt value A; use the encryption salt value A as the key to decrypt the first encrypted information S1 to obtain the certificate information M.

[0168] like Figure 4 As shown, Figure 4 A schematic diagram of the structure of a data transmission device provided in an embodiment of the present invention, wherein the device is applied to a certificate system, and comprises: a first receiving module 401, an acquisition module 402, a first encryption module 403, a second encryption module 404, a generation module 405, and a first sending module 406;

[0169] The first receiving module 401 is used to receive a certificate acquisition request sent by an edge node; wherein the certificate acquisition request at least includes authentication information for performing authority authentication on the edge node;

[0170] The acquisition module 402 is used to acquire the certificate issuer information from the determined certificate information according to the certificate acquisition request;

[0171] The first encryption module 403 is used to use the certificate issuer information as an encryption salt value, encrypt the certificate information through an encryption algorithm based on password encryption PBE, and generate first encrypted information;

[0172] The second encryption module 404 is used to encrypt the encryption salt value to generate an encrypted encryption salt value;

[0173] The generating module 405 is used to generate first data of a preset length according to the encrypted encryption salt value;

[0174] The first sending module 406 is configured to send the first data, the encrypted encryption salt value, and the first encryption information to an edge node.

[0175] like Figure 5 As shown, Figure 5 A schematic diagram of the structure of another data transmission device provided by an embodiment of the present invention, wherein the device is applied to an edge node, and comprises: a generating module 501, a second sending module 502, a receiving module 503 and a decryption module 504;

[0176] The generating module 501 is used to generate authentication information;

[0177] The second sending module 502 is used to send a certificate acquisition request including the authentication information to the certificate system;

[0178] The receiving module 503 is used to receive the first data, the encrypted encryption salt value and the first encryption information sent by the certificate system according to the certificate acquisition request;

[0179] The decryption module 504 is used to decrypt the first encrypted information according to the first data and the encrypted salt value to determine the certificate information.

[0180] To implement the method of the embodiment of the present invention, the embodiment of the present invention provides a structural diagram of another data transmission device. Specifically, Figure 6 As shown, the device 60 includes a processor 601 and a memory 602 for storing a computer program that can be run on the processor;

[0181] Wherein, when the processor 601 is used to run the computer program, it executes: receiving a certificate acquisition request sent by an edge node; wherein the certificate acquisition request at least includes authentication information for authenticating the authority of the edge node; according to the certificate acquisition request, obtaining certificate issuer information from the determined certificate information; using the certificate issuer information as an encryption salt value, encrypting the certificate information through an encryption algorithm based on password encryption PBE to generate first encrypted information; encrypting the encryption salt value to generate an encrypted encryption salt value; generating first data of a preset length according to the encrypted encryption salt value; and sending the first data, the encrypted encryption salt value and the first encryption information to the edge node.

[0182] In one embodiment, the processor 601 is also used to execute, when running the computer program: generating a first shared key; sending the first shared key to the edge node; wherein the first shared key is used by the edge node to decrypt the encrypted encryption salt value to determine the encryption salt value; encrypting the encryption salt value according to the first shared key to generate an encrypted encryption salt value.

[0183] In one embodiment, the processor 601 is further used to execute, when running the computer program: determining a preset character length; and performing base conversion on the encrypted salt value according to the preset character length to generate first data having the same length as the preset character length.

[0184] In one embodiment, the processor 601 is also used to execute the following when running the computer program: generating a second shared key; sending the second shared key to an edge node; wherein the second shared key is used by the edge node to generate authentication information; decrypting the authentication information by using the second shared key to perform authority verification on the edge node; after the authority verification of the edge node is passed, sending the first data, the encrypted encryption salt value and the first encrypted information to the edge node.

[0185] In one embodiment, the processor 601 is also used to execute the following when running the computer program: generating authentication information; sending a certificate acquisition request including the authentication information to a certificate system; receiving first data, an encrypted salt value, and first encrypted information sent by the certificate system according to the certificate acquisition request; and decrypting the first encrypted information according to the first data and the encrypted salt value to determine the certificate information.

[0186] In one embodiment, the processor 601 is also used to execute the following when running the computer program: generating a secure random number; receiving a second shared key sent by the certificate system; encrypting the secure random number based on the received second shared key by using a key-related hash operation message authentication code HMAC encryption algorithm to generate second encrypted information; and generating authentication information based on the second encrypted information.

[0187] In one embodiment, the processor 601 is also used to execute the following when running the computer program: obtaining the uniform resource identifier URI of the interface, the interface message body, and the initiation timestamp of the certificate acquisition request; encrypting the uniform resource identifier URI of the interface, the interface message body, and the initiation timestamp of the certificate acquisition request through the HMAC encryption algorithm according to the second encryption information to generate third encryption information; generating authentication information according to the third encryption information, the initiation timestamp of the certificate acquisition request and the secure random number.

[0188] In one embodiment, the processor 601 is also used to execute the following when running the computer program: determining the encrypted encryption salt value based on the first data and the preset character length determined by the certificate system; receiving the first shared key sent by the certificate system; decrypting the encrypted encryption salt value based on the first shared key to determine the encryption salt value; decrypting the first encrypted information based on the encryption salt value to determine the certificate information.

[0189] It should be noted that the data transmission device and the data transmission method embodiment provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0190] Of course, in practical applications, Figure 6 As shown, the device 60 may also include: at least one network interface 603. The various components in the data transmission device 60 are coupled together through a bus system 604. It can be understood that the bus system 604 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 604 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Figure 6 In the figure, various buses are marked as bus system 604. There may be at least one processor 601. The network interface 603 is used for wired or wireless communication between the data transmission device 60 and other devices.

[0191] The memory 602 in the embodiment of the present invention is used to store various types of data to support the operation of the data transmission device 60 .

[0192] The method disclosed in the above embodiment of the present invention can be applied to the processor 601, or implemented by the processor 601. The processor 601 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 601 or the instruction in the form of software. The above processor 601 may be a general processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 601 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present invention. The general processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present invention, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 602. The processor 601 reads the information in the memory 602 and completes the steps of the above method in combination with its hardware.

[0193] In an exemplary embodiment, the data transmission device 60 can be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), field programmable gate array (FPGA), general processor, controller, microcontroller (MCU), microprocessor, or other electronic components to execute the aforementioned method.

[0194] In an exemplary embodiment, the present invention further provides a computer-readable storage medium, such as a memory 602 including a computer program. The computer program can be executed by a processor 601 of a data transmission device 60 to complete the steps of the aforementioned method.

[0195] Specifically, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the computer program executes: receiving a certificate acquisition request sent by an edge node; wherein the certificate acquisition request includes at least authentication information for authenticating the edge node; obtaining certificate issuer information from determined certificate information according to the certificate acquisition request; using the certificate issuer information as an encryption salt value, encrypting the certificate information through an encryption algorithm based on password encryption PBE to generate first encrypted information; encrypting the encryption salt value to generate an encrypted encryption salt value; generating first data of a preset length according to the encrypted encryption salt value; and sending the first data, the encrypted encryption salt value, and the first encryption information to the edge node.

[0196] In one embodiment, when the computer program is executed by a processor, the computer program performs: generating a first shared key; sending the first shared key to the edge node; wherein the first shared key is used by the edge node to decrypt the encrypted salt value to determine the encrypted salt value; encrypting the encrypted salt value according to the first shared key to generate an encrypted salt value.

[0197] In one embodiment, when the computer program is executed by a processor, the computer program executes: determining a preset character length; and performing base conversion on the encrypted salt value according to the preset character length to generate first data having the same length as the preset character length.

[0198] In one embodiment, when the computer program is executed by the processor, the following is performed: generating a second shared key; sending the second shared key to an edge node; wherein the second shared key is used by the edge node to generate authentication information; decrypting the authentication information by the second shared key to perform authority verification on the edge node; after the authority verification on the edge node is passed, sending the first data, the encrypted encryption salt value and the first encrypted information to the edge node.

[0199] In one embodiment, when the computer program is executed by a processor, the following is performed: generating authentication information; sending a certificate acquisition request including the authentication information to a certificate system; receiving first data, an encrypted encryption salt value, and first encryption information sent by the certificate system according to the certificate acquisition request; decrypting the first encryption information according to the first data and the encrypted encryption salt value to determine the certificate information.

[0200] In one embodiment, when the computer program is executed by the processor, it performs the following steps: generating a secure random number; receiving a second shared key sent by the certificate system; encrypting the secure random number based on the received second shared key by using a key-related hash operation message authentication code HMAC encryption algorithm to generate second encrypted information; and generating authentication information based on the second encrypted information.

[0201] In one embodiment, when the computer program is executed by the processor, the following are performed: obtaining the uniform resource identifier URI of the interface, the interface message body, and the initiation timestamp of the certificate acquisition request; encrypting the uniform resource identifier URI of the interface, the interface message body, and the initiation timestamp of the certificate acquisition request by using the HMAC encryption algorithm according to the second encryption information to generate third encryption information; generating authentication information according to the third encryption information, the initiation timestamp of the certificate acquisition request and the secure random number.

[0202] In one embodiment, when the computer program is executed by the processor, the following is performed: determining the encrypted encryption salt value according to the first data and the preset character length determined by the certificate system; receiving the first shared key sent by the certificate system; decrypting the encrypted encryption salt value according to the first shared key to determine the encryption salt value; decrypting the first encrypted information according to the encryption salt value to determine the certificate information.

[0203] It should be noted that the computer-readable storage medium provided in the embodiment of the present invention may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM; or it may be various devices including one or any combination of the above memories.

[0204] The above description is only an embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement and improvement made within the spirit and scope of the present invention are included in the protection scope of the present invention.

Claims

1. A data transmission method, applied to a certificate system, characterized in that: The method comprises: Receive a certificate acquisition request sent by an edge node; wherein the certificate acquisition request includes at least authentication information; the authentication information is used to authenticate the authority of the edge node, and the authority authentication indicates that the edge node has the authority to obtain the certificate; According to the certificate acquisition request, the certificate issuer information is obtained from the determined certificate information; the certificate information is uploaded to the certificate system by the terminal; the certificate issuer information is information related to the certificate authentication center that issued the certificate or information related to the certificate; Using the certificate issuer information as the encryption salt value, encrypting the certificate information by using an encryption algorithm based on password encryption PBE to generate first encrypted information; Encrypting the encryption salt value to generate an encrypted encryption salt value; Generate first data of a preset length according to the encrypted encryption salt value; The first data, the encrypted encryption salt value and the first encryption information are sent to an edge node.

2. The data transmission method according to claim 1, characterized in that: The step of encrypting the encrypted salt value to generate an encrypted encrypted salt value includes: generating a first shared key; Sending the first shared key to the edge node; wherein the first shared key is used by the edge node to decrypt the encrypted encryption salt value to determine the encryption salt value; The encrypted salt value is encrypted according to the first shared key to generate an encrypted encrypted salt value.

3. The data transmission method according to claim 2, characterized in that: The step of generating first data of a preset length according to the encrypted salt value comprises: Determine the preset string length; According to the preset character string length, the encrypted salt value is converted into a binary system to generate first data having the same length as the preset character string.

4. The data transmission method according to claim 1, characterized in that: The method further comprises: generating a second shared key; Sending the second shared key to the edge node; wherein the second shared key is used by the edge node to generate authentication information; Decrypting the authentication information by using the second shared key to verify the authority of the edge node; After the authority verification of the edge node is passed, the first data, the encrypted encryption salt value and the first encryption information are sent to the edge node.

5. A data transmission method, applied to an edge node, characterized in that: The method comprises: Generate authentication information; Sending a certificate acquisition request including the authentication information to a certificate system; the authentication information is used by the certificate system to perform authority authentication on the edge node, and the authority authentication indicates that the edge node has the authority to obtain the certificate; Receiving first data, an encrypted encryption salt value, and first encryption information sent by the certificate system according to the certificate acquisition request; the first encryption information is obtained by encrypting the certificate information by the certificate system using the certificate issuer information as the encryption salt value; the certificate issuer information is information related to the certificate authentication center that issued the certificate or information related to the certificate; The first encrypted information is decrypted according to the first data and the encrypted salt value to determine the certificate information; the certificate information is uploaded to the certificate system by the terminal.

6. The data transmission method according to claim 5, characterized in that: The generating of authentication information comprises: Generate secure random numbers; Receiving a second shared key sent by the certificate system; According to the received second shared key, encrypt the secure random number by using a key-related hash operation message authentication code HMAC encryption algorithm to generate second encrypted information; Authentication information is generated according to the second encrypted information.

7. The data transmission method according to claim 6, characterized in that: The generating authentication information according to the second encrypted information comprises: Obtain the uniform resource identifier URI of the interface, the interface message body, and the initiation timestamp of the certificate acquisition request; According to the second encrypted information, encrypt the uniform resource identifier URI of the interface, the interface message body and the initiation timestamp of the certificate acquisition request by using the HMAC encryption algorithm to generate third encrypted information; Authentication information is generated according to the third encrypted information, the initiation timestamp of the certificate acquisition request and the secure random number.

8. The data transmission method according to claim 5, characterized in that: The decrypting the first encrypted information according to the first data and the encrypted salt value to determine the certificate information includes: Determining an encrypted salt value according to the first data and a preset character length determined by the certificate system; Receiving a first shared key sent by the certificate system; Decrypting the encrypted salt value according to the first shared key to determine the salt value; The first encrypted information is decrypted according to the encryption salt value to determine the certificate information.

9. A data transmission device, characterized in that: The device is applied to a certificate system, and comprises: a first receiving module, an acquiring module, a first encryption module, a second encryption module, a generating module and a first sending module; The first receiving module is used to receive a certificate acquisition request sent by an edge node; wherein the certificate acquisition request at least includes authentication information; the authentication information is used to perform authority authentication on the edge node, and the authority authentication indicates that the edge node has the authority to obtain the certificate; The acquisition module is used to acquire certificate issuer information from the determined certificate information according to the certificate acquisition request; the certificate information is uploaded to the certificate system by the terminal; the certificate issuer information is information related to the certificate authentication center that issued the certificate or information related to the certificate; The first encryption module is used to use the certificate issuer information as an encryption salt value, encrypt the certificate information through an encryption algorithm based on password encryption PBE, and generate first encrypted information; The second encryption module is used to encrypt the encryption salt value to generate an encrypted encryption salt value; The generating module is used to generate first data of a preset length according to the encrypted encryption salt value; The first sending module is used to send the first data, the encrypted encryption salt value and the first encryption information to the edge node.

10. A data transmission device, characterized in that: The device is applied to an edge node, and comprises: a generating module, a second sending module, a receiving module and a decrypting module; The generating module is used to generate authentication information; the authentication information is used by the certificate system to authenticate the edge node, and the authentication indicates that the edge node has the authority to obtain the certificate; The second sending module is used to send a certificate acquisition request including the authentication information to the certificate system; The receiving module is used to receive the first data, the encrypted encryption salt value and the first encryption information sent by the certificate system according to the certificate acquisition request; the first encryption information is obtained by encrypting the certificate information by the certificate system using the certificate issuer information as the encryption salt value; the certificate issuer information is information related to the certificate authentication center that issued the certificate or information related to the certificate; The decryption module is used to decrypt the first encrypted information according to the first data and the encrypted salt value to determine the certificate information; the certificate information is uploaded to the certificate system by the terminal.

11. A data transmission device, characterized in that: The apparatus comprises: a processor and a memory for storing a computer program capable of running on the processor; Wherein, when the processor is used to run the computer program, it executes the steps of the method described in any one of claims 1 to 4, or executes the steps of the method described in any one of claims 5 to 8.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 4 are implemented; or when the computer program is executed by a processor, the steps of the method described in any one of claims 5 to 8 are implemented.

Images