A data encryption transmission method, system, device and medium

Abstract

The application belongs to the computer field, and particularly relates to a data encryption transmission method, system, device and medium. The method comprises the following steps: a control field is generated according to an encryption mode of encrypted data and a storage mode of the encrypted data, and the control field is sent together when the encrypted data is sent; in response to receiving the encrypted data, a decryption mode of the encrypted data is determined according to a control field corresponding to the encrypted data, and the encrypted data is decrypted based on the decryption mode. Through the data encryption transmission method, the control field for controlling the decryption of the encrypted data is added in the encrypted data, and the encrypted data is decrypted by the decryption section guided by the control field, so that the problem that the subsequent decrypted data is difficult to decrypt when some continuous data is missing in the traditional implementation mode can be effectively solved.

Description

Technical Field

[0001] This invention belongs to the field of computer science, and specifically relates to a data encryption transmission method, system, device, and medium. Background Technology

[0002] In the field of network data transmission, data is typically encrypted for information security reasons to prevent interception by man-in-the-middle attacks. Much data on the network is transmitted using encryption methods. For example, video data is encrypted before being transmitted over the network. Encrypting video data serves two purposes: preventing interception and protecting copyright. Furthermore, because video data is streaming data composed of multiple frames, possessing a time-series characteristic, it is usually dynamically encrypted using a key-changing method. In the field of video data encryption, such as... Figure 5 The encryption mode typically used is AES-CTR. Because AES-CTR can be implemented in hardware pipelining, it is very suitable for encrypting video stream data. However, due to the complexity of the network environment and the frequent occurrence of packet loss, the decryption end cannot decrypt the data normally once packets are lost.

[0003] To address this issue, traditional implementations use the TCP protocol to ensure reliable data transmission. However, when packet loss occurs, TCP retransmits data, which solves the packet loss problem but introduces additional latency, making it unsuitable for scenarios with high real-time requirements. Furthermore, TCP has limitations on the number of connected devices when processing video data. Another approach is to control the encryption length of the video stream data, for example, by keeping the encryption length within the Ethernet payload length. Even if packet loss occurs, it will not affect the decryption of subsequent data. However, if the encryption length is too short and the key cannot be updated in a timely manner, security cannot be guaranteed.

[0004] Therefore, traditional implementation methods are insufficient to effectively solve the data encryption and decryption problem when video data packets are lost, and an effective solution is urgently needed to address the above issues. Summary of the Invention

[0005] To address the above problems, this invention proposes a data encryption transmission method, comprising:

[0006] A control field is generated based on the encryption method and storage method of the encrypted data, and the control field is sent together with the encrypted data.

[0007] In response to receiving the encrypted data, the decryption method of the encrypted data is determined according to the control field corresponding to the encrypted data, and the encrypted data is decrypted based on the decryption method.

[0008] In some embodiments of the present invention, generating a control field based on the encryption method and storage method of the encrypted data includes:

[0009] In the control field, a first start flag with a default value of a second predetermined value is set. In response to the fact that the content portion of the encrypted data contains the start data of the stream data with a sequential adjacency relationship, the first start flag is set to the first predetermined value.

[0010] In the control field, a second start flag with a default value of a second predetermined value is set. In response to the content portion of the encrypted data including the end data of the first stream data and the start data of the second stream data following the first stream data, the second start flag is set to the first predetermined value.

[0011] In some embodiments of the present invention, generating the control field based on the encryption method and storage method of the encrypted data further includes:

[0012] An end flag is set in the control field, and in response to the content portion of the encrypted data containing the end data of the stream data having a sequential adjacency relationship, the end flag is set to a first predetermined value;

[0013] In response to the fact that the content portion of the encrypted data does not contain end data of stream data with sequential adjacency, the end flag is set to a second predetermined value.

[0014] In some embodiments of the present invention, generating the control field based on the encryption method and storage method of the encrypted data further includes:

[0015] An offset bit is set in the control field. In response to the fact that the content portion of the encrypted data contains two streams of data with a sequentially adjacent relationship, the address of the starting data of the second stream of data in the encrypted data is written into the offset bit.

[0016] In some embodiments of the present invention, generating the control field based on the encryption method and storage method of the encrypted data further includes:

[0017] A first key update flag is set in the control field, and the first key update flag is set to a first predetermined value when the content part of the encrypted data contains only one stream of stream data with sequential adjacency and includes the starting data of the stream data.

[0018] In some embodiments of the present invention, generating the control field based on the encryption method and storage method of the encrypted data further includes:

[0019] In the control field, a second key update flag is set to a first predetermined value in response to the fact that the content portion of the encrypted data contains the content of two adjacent stream data and the content of the two adjacent stream data is encrypted with different keys.

[0020] In some embodiments of the present invention, determining the decryption method of the encrypted data based on the control field corresponding to the encrypted data, and decrypting the encrypted data based on the decryption method includes:

[0021] In response to the first key update flag in the control field being set to a first predetermined value, a new key is obtained and the encrypted data is decrypted using the new key;

[0022] In response to the second key update flag in the control field being set to a first predetermined value, the first stream data in the encrypted data is decrypted using the first key, and the second stream data in the encrypted data is decrypted using the acquired second key.

[0023] Another aspect of the present invention provides a data encryption transmission system, comprising:

[0024] An encryption module is configured to generate a control field based on the encryption method and storage method of the encrypted data, and to send the control field together with the encrypted data.

[0025] A decryption module is configured to, in response to receiving the encrypted data, determine the decryption method of the encrypted data based on the control field corresponding to the encrypted data, and decrypt the encrypted data based on the decryption method.

[0026] Another aspect of the present invention provides a computer device comprising:

[0027] At least one processor; and

[0028] A memory storing computer instructions executable on the processor, which, when executed by the processor, implement the steps of any of the methods described in the above embodiments.

[0029] Another aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of any of the methods described in the above embodiments.

[0030] The data encryption transmission method proposed in this invention adds a control field to the encrypted data to control the decryption of the encrypted data, and guides the decryption segment to decrypt the encrypted data through the control field. This can effectively solve the problem in traditional implementations where it is difficult to decrypt subsequent data when a certain series of data is missing. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 A flowchart illustrating a data encryption transmission method provided in an embodiment of the present invention;

[0033] Figure 2 This is a schematic diagram of the structure of a data encryption transmission system provided in an embodiment of the present invention;

[0034] Figure 3 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention;

[0035] Figure 4 This is a schematic diagram of the structure of a computer-readable storage medium provided in an embodiment of the present invention;

[0036] Figure 5 This is a schematic diagram of the AES-CTR encryption principle provided in an embodiment of the present invention;

[0037] Figure 6 This is a schematic diagram of an encrypted data format provided in an embodiment of the present invention;

[0038] Figure 7 This is a schematic diagram of the content structure of a control field provided in an embodiment of the present invention;

[0039] Figure 8 This is a schematic diagram of the encryption process, i.e., the key update process, of a data encryption transmission method provided in an embodiment of the present invention;

[0040] Figure 9 This is a schematic diagram illustrating the decryption process of a data encryption transmission method provided in an embodiment of the present invention. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to specific examples and the accompanying drawings.

[0042] It should be noted that all uses of "first" and "second" in the embodiments of the present invention are for the purpose of distinguishing two entities or parameters with the same name but different names. It is clear that "first" and "second" are only for the convenience of expression and should not be construed as limiting the embodiments of the present invention. Subsequent embodiments will not explain this in detail.

[0043] This invention aims to solve the problem of being unable to confirm the decryption key when network data packets are lost during encrypted network data transmission using AES-CTR (a counting mode symmetric encryption algorithm). The transmitted data is generally continuous (meaning the data usage and transmission methods must follow the continuity of the data content itself; for example, in providing video viewing services, it's impossible to concurrently obtain all video frames using a P2P download method, viewing only the first frame that arrives). Continuous data transmission is encrypted using AES-CTR encryption. If a segment of data is lost, subsequent data cannot be decrypted. Traditional methods, such as resending the data via TCP or obtaining the decryption key from the data provider, cause network latency, which is disastrous for scenarios with high real-time requirements, such as live streaming, where packet loss results in video pause.

[0044] like Figure 1 As shown, to solve the above problems, this invention proposes a data encryption transmission method, comprising:

[0045] Step S1: Generate a control field based on the encryption method and storage method of the encrypted data, and send the control field together with the encrypted data;

[0046] Step S2: In response to receiving the encrypted data, determine the decryption method of the encrypted data according to the control field corresponding to the encrypted data, and decrypt the encrypted data based on the decryption method.

[0047] In the embodiments of this invention, the data encryption method proposed in this invention mainly targets the encrypted transmission method of data with sequential adjacency. Sequential adjacency means that data must be arranged in the correct order to represent its intended content; typically, this is video data, which is a frame-based data format. Streaming data refers to the continuous transmission of data as a data stream; a video frame can be considered as a stream. Furthermore, the sequential adjacency in this invention includes dividing any data into blocks and encrypting it according to the block order based on AES-CTR mode. Additionally, the encrypted data in this invention refers to the content portion of a network data packet, which is the ciphertext obtained by encrypting the original text using a symmetric encryption algorithm.

[0048] The control field, as proposed in this invention, is content used to guide the data decryption party in decrypting encrypted data, such as... Figure 6 As shown, Figure 6 The diagram shows the structure of the control field and the encrypted video data, with the control field preceding the encrypted video data.

[0049] Specifically, in step S1, it is determined whether the encryption key corresponding to the encrypted data has been updated compared to the encryption key of the previous stream data. If it has been updated, the key change information is added to the control field. In addition, the storage information of the encrypted data is added to the corresponding part of the control field according to how the content of the encrypted data is stored.

[0050] In step S2, after the decryption end (which can be either a hardware decryption end or a software decryption end) receives the encrypted data, it locates the encrypted ciphertext based on the storage information of the encrypted data in the control field. Then, it determines the decryption key for decrypting the ciphertext based on the key change information in the control field. That is, if the change information indicates that the encryption key of the ciphertext is different from the decryption key of the previous data stream, the decryption end uses the newly obtained decryption key to decrypt the ciphertext. If the key change information indicates that the ciphertext does not use a new decryption key, it uses the same decryption key as the previous data stream for decryption.

[0051] Specifically, in some embodiments of the present invention, the encrypted data may contain two streams of data. As mentioned earlier, if it is video data, it may contain two frames of data; that is, the encrypted data may contain the end of the first frame and the beginning of the second frame. According to the AES-CTR encryption mode, two keys are required for encryption between the two frames. In this case, further key change information needs to be reflected in the control field.

[0052] In some embodiments of the present invention, generating a control field based on the encryption method and storage method of the encrypted data includes:

[0053] In the control field, a first start flag with a default value of a second predetermined value is set. In response to the fact that the content portion of the encrypted data contains the start data of the stream data with a sequential adjacency relationship, the first start flag is set to the first predetermined value.

[0054] In the control field, a second start flag with a default value of a second predetermined value is set. In response to the content portion of the encrypted data including the end data of the first stream data and the start data of the second stream data following the first stream data, the second start flag is set to the first predetermined value.

[0055] In this embodiment, as Figure 7As shown, the control field has a total of 48 bits. From right to left, it consists of a 32-bit Counter, followed by a 1-bit First Start Flag. The First Start Flag indicates the first data of a certain stream (i.e., in the case of video data, it indicates the start of a certain frame, because each frame of video contains a large amount of content and requires multiple data packets to be sent when transmitted over the network; if other data is segmented and sent sequentially, it refers to the beginning of a certain segment). In other words, the encrypted data sent is the start of the corresponding stream data.

[0056] Furthermore, when the encrypted data contains the beginning portion of a streaming data stream, such as the first pixel value of a video frame (i.e., the beginning portion), then in the control field such as... Figure 7 The value of S1 is set to 1. If the encrypted data does not contain the beginning of a stream of data, S1 defaults to 0.

[0057] Additionally, when the encrypted data contains two streams, it will necessarily contain the end data of one stream and the start data of the other. In this case, control fields such as... Figure 7 The value of the second start flag S2 in the control field is set to 1. If there is no start data for another stream, the second start flag in the control field is 0.

[0058] In some embodiments of the present invention, generating the control field based on the encryption method and storage method of the encrypted data further includes:

[0059] An end flag is set in the control field, and in response to the content portion of the encrypted data containing the end data of the stream data having a sequential adjacency relationship, the end flag is set to a first predetermined value;

[0060] In response to the fact that the content portion of the encrypted data does not contain end data of stream data with sequential adjacency, the end flag is set to a second predetermined value.

[0061] In this embodiment, as Figure 7 As shown, if the encrypted data contains the end data of a stream, the value of E1 in the control field is set to 1. If the encrypted data corresponds to the middle part of the stream, i.e., it contains the end data, the value of the end flag E1 in the control field is set to 0. That is, when the content of the encrypted data is only the middle part of a stream, the values ​​of S1, E1, and S2 in the control field are all 0.

[0062] In some embodiments of the present invention, generating the control field based on the encryption method and storage method of the encrypted data further includes:

[0063] An offset bit is set in the control field. In response to the fact that the content portion of the encrypted data contains two streams of data with a sequentially adjacent relationship, the address of the starting data of the second stream of data in the encrypted data is written into the offset bit.

[0064] In this embodiment, as Figure 7 As shown, when there are two adjacent streams of data in the encrypted data, that is, when the content sent in a network data packet contains the end data of one stream and the start data of another stream, and the two streams are adjacent in sequence, such as two adjacent video frames, the space from bit 37 to bit 47 (bits are counted starting from 0) of the control field is used as an offset bit (OFFSET in the figure) to store the offset position of the start data of the second stream of data (assuming that the end data of the network data packet is the first stream of data) in the encrypted data.

[0065] Furthermore, the offset can be used to identify which data in the encrypted data belongs to the encrypted content of the first stream (which is the first relative to the latter, but does not refer to the first of the data as a whole). The encrypted content of the second stream is from the offset to the end of the network packet content.

[0066] In some embodiments of the present invention, generating the control field based on the encryption method and storage method of the encrypted data further includes:

[0067] A first key update flag is set in the control field, and the first key update flag is set to a first predetermined value when the content part of the encrypted data contains only one stream of stream data with sequential adjacency and includes the starting data of the stream data.

[0068] In this embodiment, as Figure 7 As shown, when the data content in the encrypted data is the starting data of a new stream, for security reasons, the new stream data is encrypted using a new key. In this case, it is necessary to... Figure 7 The first key update flag U1 is set to 1 to tell the decryption end that the encrypted data corresponds to the start data of a stream and that the encryption key has changed.

[0069] In some embodiments of the present invention, generating the control field based on the encryption method and storage method of the encrypted data further includes:

[0070] In the control field, a second key update flag is set to a first predetermined value in response to the fact that the content portion of the encrypted data contains the content of two adjacent stream data and the content of the two adjacent stream data is encrypted with different keys.

[0071] In this embodiment, when the encrypted data contains two adjacent streams, as mentioned earlier, the encryption key needs to be updated when sending any one of the streams. Therefore, for the encrypted data content portion of a network data packet containing two streams, there exists ciphertext encrypted with two keys, corresponding to the end data of the first stream and the start data of the second stream, respectively. Therefore, this invention sets a second key update flag in the control field as follows: Figure 7 In the context of U2, the value of U2 needs to be set to 1.

[0072] In some embodiments of the present invention, determining the decryption method of the encrypted data based on the control field corresponding to the encrypted data, and decrypting the encrypted data based on the decryption method includes:

[0073] In response to the first key update flag in the control field being set to a first predetermined value, a new key is obtained and the encrypted data is decrypted using the new key;

[0074] In response to the second key update flag in the control field being set to a first predetermined value, the first stream data in the encrypted data is decrypted using the first key, and the second stream data in the encrypted data is decrypted using the acquired second key.

[0075] In this embodiment, after the decryption end receives the encrypted network data packet, it obtains the corresponding control field and decrypts the encrypted data part according to the corresponding flag in the control field.

[0076] Specifically, when the first key update flag U1 in the control field is 1, the new key currently used for encryption is obtained from the source of the symmetric key (generally, the new decryption key will arrive at the decryption end before the encrypted data). The encrypted data in the network data packet is decrypted using the new key to obtain the corresponding plaintext.

[0077] When the second key update flag U2 in the control field is 1, the encrypted data in ciphertext form is split into two parts according to the OFFSET value in the control field, corresponding to two data streams. The ciphertext of the first data stream is decrypted using the original decryption key. The corresponding second data stream is then decrypted using the newly acquired decryption key. This yields the corresponding plaintext. Furthermore, after decrypting the second data stream, the new decryption key is used as the decryption key for the encrypted data of the next network data packet. The number of subsequent encrypted data streams depends on the size of the data streams and network data packets.

[0078] Example:

[0079] In this embodiment, a video stream data is used as an example to illustrate the data encryption transmission method proposed in this invention, such as... Figure 6 As shown, the UDP packet payload when the encrypted end transmits data over the network consists of two parts: a control field and video stream data. The control field can be encrypted or not, depending on the requirements. When the control field needs to be encrypted during transmission, block cipher algorithms such as AES-ECB or SM4 can be used for encryption. The encryption of the control field and the encryption of the video stream data are two independent processes; the video stream data is encrypted using the AES-CTR symmetric cipher algorithm.

[0080] like Figure 6 As shown, the control field must contain at least the following information (from right to left):

[0081] (1) COUNTER: Counter. 32 bits or more, related to the encryption length, used to indicate the position of the first ciphertext data contained in the current UDP packet, i.e., which data point, counting from 0. For example, assuming a 1000-byte video stream is encrypted and transmitted in two packets, each containing 500 bytes, the counter for the first packet is set to 0, and the counter for the second packet is set to 500.

[0082] (2) S1: Start of Frame Flag. This bit is set to 1 when the first packet of a certain frame of video data is sent.

[0083] (3) E1: End of frame flag. This bit is set to 1 when the last packet of a video frame is sent.

[0084] (4) S2: Start of Frame Flag. When a data packet contains data from two video frames (the end of the previous video frame and the beginning of the next video frame), this bit and the E1 bit are both set to 1.

[0085] (5) U1: Key update flag. This bit will be flipped once when the key is updated. The initial value is 0.

[0086] (6) U2: Key update flag. This bit toggles once when the key is updated; its initial value is 0. It is used to indicate whether the second frame of video data has been updated when a data packet contains data from two video frames.

[0087] (7) OFFSET: Offset bit, 11 bits. Used to indicate the starting position of the second frame of video data when a data packet contains data from two video frames.

[0088] In this embodiment, as Figure 8 As shown, this invention uses a hardware-implemented encryption process as an example. Specifically, two registers, R0 and R1, are set up at the encryption end to store the key. The encryption end always uses the key stored in register R0 to encrypt the video stream data, and register R1 stores the updated key. The encryption end's hardware and software work together to be responsible for data encryption and key updates.

[0089] (1) Before enabling encryption, the encryption software generates a symmetric key and configures it to the encryption end through the register, and at the same time sends the key to the decryption end through the network.

[0090] (2) The encryption end saves the received key in the R0 register and uses the key saved in R0 to encrypt the video stream data;

[0091] (3) The encryption end sends a key update request at an opportune time. For example, if the encryption length is configured to be 100 frames, the key update request is sent at the 50th frame.

[0092] (4) After receiving the key update request, the encryption software updates the key and configures it to the encryption end through the register, and at the same time sends the key to the decryption end through the network.

[0093] (5) The encryption end stores the received key in the R1 register;

[0094] (6) When the current encryption length ends, the encryption hardware logic updates the key at the inter-frame interval and then uses the updated key to encrypt the video stream data.

[0095] Furthermore, such as Figure 9 As shown, during the decryption process at the decryption end, similar to the encryption end, the decryption end also sets up two registers: R0 and R1, which are used to store the key. R0 is used to store the current key or the default key, which means that the default key is used for decryption until the end of a certain frame of data appears. R1 is used to store the newly obtained decryption key.

[0096] Furthermore, the video stream data is always decrypted using the key stored in register R0 at the decryption end, while register R1 stores the updated key. When a key update is detected, the value of register R1 is assigned to register R0. The decryption process at the decryption end is as follows:

[0097] (1) When the decryption end receives a data packet, it performs a decryption operation on the control field when the control field is encrypted.

[0098] (2) When S2=1, E1=1, S1=0 is detected, the boundary between the two frames is defined according to the OFFSET field. The data of the previous frame is decrypted using the current key and COUNTER. When a key update is detected, the data of the next frame is decrypted using the updated key. Otherwise, the data is decrypted using the current key and COUNTER.

[0099] (3) When S2=0, E1=0, S1=1 is detected, it is the start of a new frame. When a key update is detected, the updated key is used for decryption; otherwise, the current key and COUNTER are used for decryption.

[0100] (4) When S2=0, E1=1, and S1=0 are detected, it is the end of a frame. Use the current key and COUNTER to decrypt.

[0101] (5) When S2=0, E1=0, S1=0 is detected, decrypt using the current key and COUNTER.

[0102] like Figure 2 As shown, another aspect of the present invention provides a data encryption transmission system, comprising:

[0103] Encryption module 1 is configured to generate a control field based on the encryption method and storage method of the encrypted data, and to send the control field together with the encrypted data.

[0104] Decryption module 2 is configured to, in response to receiving the encrypted data, determine the decryption method of the encrypted data according to the control field corresponding to the encrypted data, and decrypt the encrypted data based on the decryption method.

[0105] like Figure 3 As shown, another aspect of the present invention also provides a computer device comprising:

[0106] At least one processor 21; and

[0107] Memory 22 stores computer instructions 23 executable on processor 21. When executed by processor 21, the instructions 23 implement a data encryption transmission method, including:

[0108] A control field is generated based on the encryption method and storage method of the encrypted data, and the control field is sent together with the encrypted data.

[0109] In response to receiving the encrypted data, the decryption method of the encrypted data is determined according to the control field corresponding to the encrypted data, and the encrypted data is decrypted based on the decryption method.

[0110] In some embodiments of the present invention, generating a control field based on the encryption method and storage method of the encrypted data includes:

[0111] In the control field, a first start flag with a default value of a second predetermined value is set. In response to the fact that the content portion of the encrypted data contains the start data of the stream data with a sequential adjacency relationship, the first start flag is set to the first predetermined value.

[0112] In the control field, a second start flag with a default value of a second predetermined value is set. In response to the content portion of the encrypted data including the end data of the first stream data and the start data of the second stream data following the first stream data, the second start flag is set to the first predetermined value.

[0113] In some embodiments of the present invention, generating the control field based on the encryption method and storage method of the encrypted data further includes:

[0114] An end flag is set in the control field, and in response to the content portion of the encrypted data containing the end data of the stream data having a sequential adjacency relationship, the end flag is set to a first predetermined value;

[0115] In response to the fact that the content portion of the encrypted data does not contain end data of stream data with sequential adjacency, the end flag is set to a second predetermined value.

[0116] In some embodiments of the present invention, generating the control field based on the encryption method and storage method of the encrypted data further includes:

[0117] An offset bit is set in the control field. In response to the fact that the content portion of the encrypted data contains two streams of data with a sequentially adjacent relationship, the address of the starting data of the second stream of data in the encrypted data is written into the offset bit.

[0118] In some embodiments of the present invention, generating the control field based on the encryption method and storage method of the encrypted data further includes:

[0119] A first key update flag is set in the control field, and the first key update flag is set to a first predetermined value when the content part of the encrypted data contains only one stream of stream data with sequential adjacency and includes the starting data of the stream data.

[0120] In some embodiments of the present invention, generating the control field based on the encryption method and storage method of the encrypted data further includes:

[0121] In the control field, a second key update flag is set to a first predetermined value in response to the fact that the content portion of the encrypted data contains the content of two adjacent stream data and the content of the two adjacent stream data is encrypted with different keys.

[0122] In some embodiments of the present invention, determining the decryption method of the encrypted data based on the control field corresponding to the encrypted data, and decrypting the encrypted data based on the decryption method includes:

[0123] In response to the first key update flag in the control field being set to a first predetermined value, a new key is obtained and the encrypted data is decrypted using the new key;

[0124] In response to the second key update flag in the control field being set to a first predetermined value, the first stream data in the encrypted data is decrypted using the first key, and the second stream data in the encrypted data is decrypted using the acquired second key.

[0125] like Figure 4 As shown, another aspect of the present invention provides a computer-readable storage medium 401, which stores a computer program 402. When executed by a processor, the computer program 402 implements a data encryption transmission method, comprising:

[0126] A control field is generated based on the encryption method and storage method of the encrypted data, and the control field is sent together with the encrypted data.

[0127] In response to receiving the encrypted data, the decryption method of the encrypted data is determined according to the control field corresponding to the encrypted data, and the encrypted data is decrypted based on the decryption method.

[0128] In some embodiments of the present invention, generating a control field based on the encryption method and storage method of the encrypted data includes:

[0129] In the control field, a first start flag with a default value of a second predetermined value is set. In response to the fact that the content portion of the encrypted data contains the start data of the stream data with a sequential adjacency relationship, the first start flag is set to the first predetermined value.

[0130] In the control field, a second start flag with a default value of a second predetermined value is set. In response to the content portion of the encrypted data including the end data of the first stream data and the start data of the second stream data following the first stream data, the second start flag is set to the first predetermined value.

[0131] In some embodiments of the present invention, generating the control field based on the encryption method and storage method of the encrypted data further includes:

[0132] An end flag is set in the control field, and in response to the content portion of the encrypted data containing the end data of the stream data having a sequential adjacency relationship, the end flag is set to a first predetermined value;

[0133] In response to the fact that the content portion of the encrypted data does not contain end data of stream data with sequential adjacency, the end flag is set to a second predetermined value.

[0134] In some embodiments of the present invention, generating the control field based on the encryption method and storage method of the encrypted data further includes:

[0135] An offset bit is set in the control field. In response to the fact that the content portion of the encrypted data contains two streams of data with a sequentially adjacent relationship, the address of the starting data of the second stream of data in the encrypted data is written into the offset bit.

[0136] In some embodiments of the present invention, generating the control field based on the encryption method and storage method of the encrypted data further includes:

[0137] A first key update flag is set in the control field, and the first key update flag is set to a first predetermined value when the content part of the encrypted data contains only one stream of stream data with sequential adjacency and includes the starting data of the stream data.

[0138] In some embodiments of the present invention, generating the control field based on the encryption method and storage method of the encrypted data further includes:

[0139] In the control field, a second key update flag is set to a first predetermined value in response to the fact that the content portion of the encrypted data contains the content of two adjacent stream data and the content of the two adjacent stream data is encrypted with different keys.

[0140] In some embodiments of the present invention, determining the decryption method of the encrypted data based on the control field corresponding to the encrypted data, and decrypting the encrypted data based on the decryption method includes:

[0141] In response to the first key update flag in the control field being set to a first predetermined value, a new key is obtained and the encrypted data is decrypted using the new key;

[0142] In response to the second key update flag in the control field being set to a first predetermined value, the first stream data in the encrypted data is decrypted using the first key, and the second stream data in the encrypted data is decrypted using the acquired second key.

[0143] The above are exemplary embodiments disclosed in this invention. However, it should be noted that various changes and modifications can be made without departing from the scope of the embodiments of this invention as defined by the claims. The functions, steps, and / or actions of the methods according to the disclosed embodiments described herein do not need to be performed in any particular order. Furthermore, although the elements disclosed in the embodiments of this invention may be described or claimed individually, they may be understood as multiple unless explicitly limited to a singular number.

[0144] It should be understood that, as used herein, the singular form “a” is intended to include the plural form as well, unless the context clearly supports an exception. It should also be understood that, as used herein, “and / or” refers to any and all possible combinations of one or more of the associated listed items.

[0145] The embodiment numbers disclosed in the above embodiments of the present invention are merely for description and do not represent the superiority or inferiority of the embodiments.

[0146] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0147] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of the invention (including the claims) is limited to these examples. Within the framework of the invention, technical features of the above embodiments or different embodiments can be combined, and many other variations of the different aspects of the invention as described above exist, which are not provided in the details for the sake of brevity. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the invention should be included within the protection scope of the invention.

Claims

1. A method for encrypted data transmission, characterized in that, include: A control field is generated based on the encryption method and storage method of the encrypted data, and the control field is sent together with the encrypted data. In response to receiving the encrypted data, the decryption method of the encrypted data is determined according to the control field corresponding to the encrypted data, and the encrypted data is decrypted based on the decryption method; The process of generating control fields based on the encryption method and storage method of the encrypted data includes: In the control field, a first start flag with a default value of a second predetermined value is set. In response to the fact that the content portion of the encrypted data contains the start data of the stream data with a sequential adjacency relationship, the first start flag is set to the first predetermined value. In the control field, a second start flag with a default value of a second predetermined value is set. In response to the content portion of the encrypted data including the end data of the first stream data and the start data of the second stream data after the first stream data, the second start flag is set to the first predetermined value. An end flag is set in the control field, and in response to the content portion of the encrypted data containing the end data of the stream data having a sequential adjacency relationship, the end flag is set to a first predetermined value; In response to the fact that the content portion of the encrypted data does not contain end data of stream data with a sequential adjacency relationship, the end flag is set to a second predetermined value; An offset bit is set in the control field. In response to the fact that the content portion of the encrypted data contains two streams of data with a sequentially adjacent relationship, the address of the starting data of the second stream of data in the encrypted data is written into the offset bit.

2. The method according to claim 1, characterized in that, The process of generating control fields based on the encryption method and storage method of the encrypted data also includes: A first key update flag is set in the control field, and the first key update flag is set to a first predetermined value when the content part of the encrypted data contains only one stream of stream data with sequential adjacency and includes the starting data of the stream data.

3. The method according to claim 1, characterized in that, The process of generating control fields based on the encryption method and storage method of the encrypted data also includes: In the control field, a second key update flag is set. In response to the fact that the content portion of the encrypted data contains the content of two adjacent stream data and the content of the two adjacent stream data is encrypted with different keys, the second key update flag is set to a first predetermined value.

4. The method according to claim 1, characterized in that, The step of determining the decryption method of the encrypted data based on the control field corresponding to the encrypted data, and decrypting the encrypted data based on the decryption method, includes: In response to the first key update flag in the control field being set to a first predetermined value, a new key is obtained and the encrypted data is decrypted using the new key; In response to the second key update flag in the control field being set to a first predetermined value, the first stream data in the encrypted data is decrypted using the first key, and the second stream data in the encrypted data is decrypted using the acquired second key.

5. A data encryption transmission system, characterized in that, include: An encryption module is configured to generate a control field based on the encryption method and storage method of the encrypted data, and to send the control field together with the encrypted data. A decryption module is configured to, in response to receiving the encrypted data, determine the decryption method of the encrypted data based on the control field corresponding to the encrypted data, and decrypt the encrypted data based on the decryption method; The encryption module is further used for: In the control field, a first start flag with a default value of a second predetermined value is set. In response to the fact that the content portion of the encrypted data contains the start data of the stream data with a sequential adjacency relationship, the first start flag is set to the first predetermined value. In the control field, a second start flag with a default value of a second predetermined value is set. In response to the content portion of the encrypted data including the end data of the first stream data and the start data of the second stream data after the first stream data, the second start flag is set to the first predetermined value. An end flag is set in the control field, and in response to the content portion of the encrypted data containing the end data of the stream data having a sequential adjacency relationship, the end flag is set to a first predetermined value; In response to the fact that the content portion of the encrypted data does not contain end data of stream data with a sequential adjacency relationship, the end flag is set to a second predetermined value; An offset bit is set in the control field. In response to the fact that the content portion of the encrypted data contains two streams of data with a sequentially adjacent relationship, the address of the starting data of the second stream of data in the encrypted data is written into the offset bit.

6. A computer device, characterized in that, include: At least one processor; as well as A memory storing computer instructions executable on the processor, which, when executed by the processor, implement the steps of the method according to any one of claims 1-4.

7. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method according to any one of claims 1-4.

Images