Data transmission method, data transmission device, electronic equipment and readable storage medium

Abstract

The application discloses a data transmission method, an electronic device and a readable storage medium. The method comprises the following steps: sending a first message to a receiving end; receiving a second message fed back by the receiving end for the first message; and sending target transmission data to the receiving end in the case that the encrypted verification information is decrypted by a second session key to obtain the preset verification information, wherein the second session key is generated based on a first random number and a second random number, the target transmission data comprises second encrypted data and third encrypted data, the second encrypted data is data obtained by encrypting an identifier of a target encryption algorithm by using the second session key, and the third encrypted data is data obtained by encrypting original transmission data by using the target encryption algorithm.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a data transmission method, an electronic device, and a readable storage medium. Background Technology

[0002] With the rapid development of computer technology, automated office work has become increasingly common. OA (Office Automation) systems can achieve transparency and standardization in internal enterprise management, improve work efficiency, and reduce management costs. For example, online workflow approvals can automatically record the behavior and operations of all personnel, reducing the cost of manual review and eliminating repetitive manual tasks. Simultaneously, automated office systems generate a series of data, which is generally uploaded to the cloud. This involves data transmission between the client and the cloud. To ensure data security and privacy, security measures such as data encryption, access control, and authentication are typically adopted to protect the confidentiality and integrity of sensitive data. However, traditional data encryption transmission technologies do not address how the receiving end can quickly decrypt the data. Decrypting through all decryption strategies is undoubtedly complex and resource-intensive, while directly transmitting the encrypted information leads to insufficient security. Summary of the Invention

[0003] This application provides a data transmission method, an electronic device, and a readable storage medium, which can solve the problem of how to ensure the security of transmission under the premise of transmission encryption strategy.

[0004] To solve the above-mentioned technical problems, this application is implemented as follows:

[0005] In a first aspect, a data transmission method is provided, applied at a sending end, comprising: sending a first message to a receiving end, wherein the first message carries first encrypted data, the first encrypted data being data obtained by encrypting a first random number using a target verification key, the target verification key being a key negotiated with the receiving end based on a first preset rule; receiving a second message fed back by the receiving end in response to the first message, wherein the second message carries a second random number and encrypted verification information, the encrypted verification information being information obtained by encrypting preset verification information using a first session key, the first session key being generated based on the first random number and a second random number; and, upon decrypting the encrypted verification information using the second session key to obtain the preset verification information, sending target transmission data to the receiving end, wherein the second session key is generated based on the first random number and the second random number, the target transmission data including second encrypted data and third encrypted data, the second encrypted data being data encrypted using the second session key with an identifier of a target encryption algorithm, and the third encrypted data being data obtained by encrypting original transmission data using the target encryption algorithm.

[0006] Secondly, a data transmission method is provided, applied at a receiving end, comprising: receiving a first message sent by a sending end, wherein the first message carries first encrypted data, the first encrypted data being data obtained by encrypting a first random number using a target verification key, the target verification key being a key negotiated with the sending end based on a first preset rule; feeding back a second message to the sending end in response to the first message, wherein the second message carries a second random number and encrypted verification information, wherein the encrypted verification information is information obtained by encrypting preset verification information using a first session key, the first session key being generated based on the first random number and a second random number; when the sending end decrypts the encrypted verification information using the second session key to obtain the preset verification information, receiving target transmission data sent by the sending end, wherein the target transmission data includes second encrypted data and third encrypted data, the second encrypted data being data encrypted using the second session key to encrypt an identifier of a target encryption algorithm, and the third encrypted data being data obtained by encrypting original transmission data using the target encryption algorithm; when the second encrypted data is decrypted using the first session key to obtain the identifier of the target encryption algorithm, the third encrypted data is decrypted using the target encryption algorithm to obtain the original transmission data.

[0007] Thirdly, a data transmission device is provided, applied at a sending end, comprising: a first sending module, configured to send a first message to a receiving end, wherein the first message carries first encrypted data, the first encrypted data being data obtained by encrypting a first random number using a target verification key, the target verification key being a key negotiated with the receiving end based on a first preset rule; a receiving module, configured to receive a second message fed back by the receiving end in response to the first message, wherein the second message carries a second random number and encrypted verification information, the encrypted verification information being information obtained by encrypting preset verification information using a first session key, the first session key being generated based on the first random number and a second random number; and a second sending module, configured to send target transmission data to the receiving end after decrypting the encrypted verification information using the second session key to obtain the preset verification information, wherein the second session key is generated based on the first random number and the second random number, the target transmission data including second encrypted data and third encrypted data, the second encrypted data being data encrypted using the second session key with an identifier of a target encryption algorithm, and the third encrypted data being data obtained by encrypting the original transmission data using the target encryption algorithm.

[0008] Fourthly, a data transmission device is provided, applied at a receiving end, comprising: a first receiving module, configured to receive a first message sent by a sending end, wherein the first message carries first encrypted data, the first encrypted data being data obtained by encrypting a first random number using a target verification key, the target verification key being a key negotiated with the sending end based on a first preset rule; and a feedback module, configured to feed back a second message to the sending end in response to the first message, wherein the second message carries a second random number and encrypted verification information, wherein the encrypted verification information is information obtained by encrypting preset verification information using a first session key, the first session key being generated based on the first random number and the second random number. The system comprises: a second receiving module, configured to receive target transmission data sent by the receiving end when the sending end decrypts the encrypted verification information using the second session key to obtain the preset verification information; wherein the target transmission data includes second encrypted data and third encrypted data, the second encrypted data being data encrypted using the second session key with the identifier of the target encryption algorithm, and the third encrypted data being data obtained by encrypting the original transmission data using the target encryption algorithm; and a decryption module, configured to decrypt the third encrypted data using the target encryption algorithm when the sending end decrypts the second encrypted data using the first session key to obtain the identifier of the target encryption algorithm, to obtain the original transmission data.

[0009] Fifthly, an electronic device is provided, the electronic device comprising a processor and a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor to implement the steps of the method described in the first aspect above, or to implement the steps of the method described in the second aspect above.

[0010] In a sixth aspect, a readable storage medium is provided, wherein at least one computer program is stored therein, the computer program being loaded and executed by a processor to implement the steps of the method described in the first aspect above, or to implement the steps of the method described in the second aspect above.

[0011] In a seventh aspect, a computer program product is provided, the computer program product comprising at least one computer program, the computer program being loaded and executed by a processor to implement the steps of the method described in the first aspect above, or to implement the steps of the method described in the second aspect above.

[0012] In this embodiment, a first message is sent to the receiving end, and then a second message is received from the receiving end in response to the first message. The second message carries a second random number and encrypted verification information. The encrypted verification information is obtained by encrypting preset verification information using a first session key. The first session key is generated based on the first and second random numbers. Finally, the target transmission data is sent to the receiving end after decrypting the encrypted verification information using the second session key to obtain the preset verification information. This achieves the transmission of encryption strategies based on real-time generated session keys. Simultaneously, through two interactions between the verification key and the session key, secure authentication between the two ends of the data transmission is completed, and a session key is generated for the encryption strategy. Using the session key to encrypt the encryption algorithm itself allows the receiving end to quickly determine the decryption method. Furthermore, the encryption methods for the transmitted ciphertext and the algorithm identifier ciphertext are different, and the session key is also generated in real-time based on this transmission. Thus, while facilitating rapid decryption by the receiving end, the encryption strength and data transmission security are guaranteed. Attached Figure Description

[0013] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0014] Figure 1 This illustration shows a flowchart of a data transmission method provided in an exemplary embodiment of this application;

[0015] Figure 2 This illustration shows another flowchart of a data transmission method provided in an exemplary embodiment of this application;

[0016] Figure 3 This illustration shows an interactive schematic diagram of a data transmission method provided by an exemplary embodiment of this application;

[0017] Figure 4 This illustration shows a schematic diagram of a data transmission apparatus provided in an exemplary embodiment of this application;

[0018] Figure 5 This invention provides a schematic diagram of another structure of a data transmission apparatus according to an exemplary embodiment of the present application;

[0019] Figure 6 A schematic diagram of the structure of an electronic device provided in an exemplary embodiment of this application is shown. Detailed Implementation

[0020] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0021] Figure 1 This diagram illustrates a data transmission method according to an embodiment of this application, which can be executed by the sending end. Figure 1 As shown, the method may include the following steps.

[0022] S110: Send the first message to the receiving end.

[0023] The first message carries first encrypted data, which is data obtained by encrypting a first random number using a target verification key. The target verification key is a key negotiated with the receiving end based on a first preset rule.

[0024] The first preset rule includes one of the following:

[0025] (1) Determine the target verification key based on the historical session key from the last transmission.

[0026] (2) Determine the target verification key based on the historical data transmission volume between the sending end and the receiving end during the last transmission.

[0027] (3) Determine the target verification key based on the data transmission start time and / or data transmission end time between the sending end and the receiving end during the last transmission.

[0028] (4) Determine the target verification key according to the preset key change table.

[0029] (5) Determine the target verification key based on the key negotiated by the sending end and the receiving end based on the key change table at the end of the last transmission.

[0030] Understandably, by using historical session information, it can be ensured that both communicating parties are legitimate, and that the generated key is secure and known only to the communicating parties. Optionally, a secret key can be determined after each transmission as the verification key for the next transmission.

[0031] S120: Receive the second message fed back by the receiving end in response to the first message.

[0032] The second message carries a second random number and encrypted verification information. The encrypted verification information is information obtained by encrypting preset verification information using a first session key. The first session key is generated based on the first random number and the second random number.

[0033] Understandably, after receiving the first message from the sender, the receiving end decrypts the first encrypted data based on the target verification key to obtain a first random number. Then, based on the obtained first random number and the generated second random number, a first session key is generated. Finally, the first session key is used to encrypt the preset verification information to obtain the encrypted verification information.

[0034] S130: After decrypting the encrypted verification information using the second session key to obtain the preset verification information, send the target transmission data to the receiving end.

[0035] The second session key is generated based on the first random number and the second random number. The target transmission data includes second encrypted data and third encrypted data. The second encrypted data is data after encrypting the identifier of the target encryption algorithm using the second session key. The third encrypted data is data obtained by encrypting the original transmission data using the target encryption algorithm.

[0036] Understandably, after receiving the second message from the receiver, the sending end generates a second session key based on the first random number and the second random number in the second message. It then uses this second session key to decrypt the encrypted verification message. If decryption is successful, the preset verification information is obtained, meaning the second session key matches the first session key. If decryption fails, the preset verification information cannot be obtained, meaning the second session key does not match the first session key. Therefore, with the preset verification information obtained, the target data can be sent to the receiver. Furthermore, the target encryption algorithm is the encryption strategy. Since both the sending and receiving ends know multiple encryption algorithms, only the identifier of the target encryption algorithm needs to be encrypted to protect the encryption strategy. After obtaining the identifier of the target encryption algorithm, the receiver will decrypt it according to the target encryption algorithm corresponding to that identifier. Thus, the data transmission process is equivalent to four encryption steps: from the verification key and session key. Even after determining the encryption algorithm identifier, the specific encryption algorithm corresponding to the identifier must be determined and then decrypted to obtain the transmitted data, ensuring the security of the data transmission.

[0037] In addition, to facilitate the transmission of encryption algorithm information, a unique algorithm identifier (ID) can be assigned to each encryption algorithm. The encryption algorithm can be uniquely identified based on the algorithm identifier ID, and both the sending and receiving ends can determine the specific encryption algorithm based on the ID. Optionally, the definition of the algorithm identifier ID can be: security level + number within the same security level, where the security level is identified using S1, S2, ..., and the number is identified using 0001, 0002, ...

[0038] Furthermore, to facilitate the transmission of encryption algorithm information, a unique algorithm identifier ID can be set for each encryption algorithm. The encryption algorithm can be uniquely identified based on the algorithm identifier ID, and both the sending end and the receiving end can determine the specific encryption algorithm based on the algorithm identifier ID.

[0039] In this embodiment, a first message is sent to the receiving end, and then a second message is received from the receiving end in response to the first message. The second message carries a second random number and encrypted verification information. The encrypted verification information is obtained by encrypting preset verification information using a first session key. The first session key is generated based on the first and second random numbers. Finally, after decrypting the encrypted verification information using the second session key to obtain the preset verification information, the target transmission data is sent to the receiving end based on the second session key. This achieves the transmission of encryption strategy based on a real-time generated session key. Simultaneously, through the two interactions of the verification key and the session key, secure authentication between the two ends of the data transmission is completed, and a session key is generated for the encryption strategy. Using the session key to encrypt the encryption algorithm itself allows the receiving end to quickly determine the decryption method. Furthermore, the encryption methods for the transmitted ciphertext and the algorithm identifier ciphertext are different, and the session key is also generated in real-time based on this transmission. Thus, while facilitating rapid decryption by the receiving end, the encryption strength and data transmission security are guaranteed.

[0040] In one implementation, the second message further includes a second preset rule, wherein the second preset rule is used to represent the encryption rule of the encryption verification information; before sending the target transmission data to the receiving end, the method further includes: generating a second session key based on the first random number and the second random number according to the second preset rule.

[0041] Understandably, the receiving end can use the second preset rule to generate the first session key, and then use the first session key to encrypt the preset verification information to obtain the encrypted verification information. Therefore, when the receiving end sends out the second message, it can include this second preset rule to inform the sending end how to generate the second session key.

[0042] In another implementation, the second preset rule includes one of the following:

[0043] (1) When the first random number and the second random number are encrypted using the first preset key to obtain the first ciphertext, the second session key is determined based on the hash value of the first ciphertext.

[0044] (2) When the target operation result is encrypted using the second preset key to obtain the second ciphertext, the second session key is determined based on the hash value of the second ciphertext, wherein the target operation result is obtained by performing a preset operation on the first random number and the second random number.

[0045] (3) When the first random number, the second random number, the device information of the sending end, the device information of the receiving end and the preset extended information are encrypted using the third preset key to obtain the third ciphertext, the second session key is determined according to the hash value of the third ciphertext.

[0046] In one implementation, before sending the target transmission data to the receiving end, the method further includes: acquiring the original transmission data; acquiring a target encryption algorithm that matches the original transmission data; and encrypting the original transmission data using the target encryption algorithm to obtain the third encrypted data.

[0047] Raw transmitted data refers to information that has not undergone any encryption processing; it can be any form of data, including numbers, text, images, or other types of data.

[0048] Optionally, "matching" means that the determined target encryption algorithm corresponds to the confidentiality level of the original transmitted data. For example, sensitive and private data in a business system have a higher confidentiality level, while non-sensitive data and basic information in the same system have a lower confidentiality level. Confidentiality levels can include different levels, such as high-strength, medium-strength, and low-strength. Data that does not require encryption has an "unencrypted" confidentiality level, or it can be defined as Level 1, Level 2, Level 3, Level 4, etc., with at least one encryption algorithm available for each level. For example, contract forms or documents used as original transmitted data have a very high confidentiality level; forms or documents containing employee identification or salary information also have a very high confidentiality level; documents containing company technical secrets also have a high confidentiality level, while routine purchase forms and leave approval forms can have a slightly lower confidentiality level. Therefore, it is necessary to determine the corresponding target encryption algorithm based on the confidentiality level of the original transmitted data. This allows the original transmitted data to be converted into ciphertext of different levels, thus ensuring the security of the original transmitted data.

[0049] Optionally, the target encryption algorithm may include, but is not limited to, the following types: hash algorithm, symmetric encryption algorithm, and asymmetric encryption algorithm. Among them, symmetric encryption algorithms include, but are not limited to, DES, 3DES, and AES; asymmetric algorithms include, but are not limited to, RSA and DSA; and hash algorithms include, but are not limited to, SHA-1 and MD5.

[0050] In one implementation, the original transmitted data includes at least one form data, and the target encryption algorithm includes at least one first encryption algorithm; obtaining the target encryption algorithm matching the original transmitted data includes: determining the security level corresponding to each form data; and selecting the first encryption algorithm corresponding to each form from at least one encryption algorithm associated with the security level corresponding to each form data according to the user permissions of the current user, wherein the at least one encryption algorithm associated with each security level is determined according to a preset evaluation index, and the preset evaluation index includes at least one of the following: encryption algorithm complexity, resistance to attacks, standardization, encryption speed, and resource consumption.

[0051] It is understandable that the original transmitted data may include at least one form data, and each form data may correspond to a different level of confidentiality. Therefore, it is necessary to determine the level of confidentiality corresponding to each form data, and then determine the first encryption algorithm corresponding to each form.

[0052] In addition, each security level corresponds to at least one encryption algorithm, so the first encryption algorithm can be determined based on the evaluation criteria.

[0053] For example, regarding the pre-defined evaluation metric of encryption algorithm complexity, it's understandable that the complexity of an encryption algorithm determines its security and performance. An ideal encryption algorithm should have high complexity to make it difficult for attackers to analyze its internal structure. However, overly complex algorithms may lead to performance degradation, so a balance needs to be found between security and performance. Therefore, a complexity metric for encryption algorithms can be established, typically measured by the time and space complexity required to execute the algorithm.

[0054] Regarding the pre-defined evaluation metric of resistance to attacks, it's understandable that devices A and B can transmit data to simulate different attack types, recording the number of times the algorithm is cracked. This allows for the assessment of the encryption method's resistance to attacks. Simultaneously, historical data on the use of this encryption method can also be obtained and used as experimental data to calculate its resistance level. Therefore, the ability to resist attacks is defined as an attack resistance metric, with the following formula:

[0055] W=(r1*Q1+r2*Q2+r3*Q3+…+rN*QN)÷(Num)

[0056] Here, r1, r2, ... rN are weights manually set for different attack types, Q1, Q2, ... QN are the number of times the corresponding attack type was cracked, and Num is the total number of attacks.

[0057] Optionally, the first encryption algorithm for each form can be determined based on expert experience.

[0058] Furthermore, even at the same level, different user permissions can allow for different types and numbers of encryption algorithms to be selected. In other words, the permissions of the form editor or sender are also considered when choosing an encryption algorithm. Users with different permissions access different levels of forms and have different levels of security; therefore, different encryption methods can be offered based on user permissions.

[0059] This implementation provides users with more options when determining the encryption method within the same level of security, thereby improving the user experience.

[0060] Furthermore, in another implementation, each of the form data includes at least one field, and each of the first encryption algorithms includes at least one second encryption algorithm;

[0061] The step of selecting the first encryption algorithm corresponding to each form from at least one encryption algorithm associated with the confidentiality level of each form data according to the user permissions of the current user includes:

[0062] For each form data, the form data is divided into multiple sub-forms according to the sensitivity of each field. The confidentiality level corresponding to each sub-form is determined, and the second encryption algorithm corresponding to each sub-form is selected from at least one encryption algorithm associated with the confidentiality level of each sub-form.

[0063] Understandably, for forms containing multiple fields, some of which are sensitive data, such as ID card numbers or bank card numbers, while others are non-sensitive data, such as the university or college one graduated from, a form can be divided into multiple subforms. Each subform contains one or more fields, and each subform is used as the raw data for transmission. Each subform is assigned a security level, and then the data transmission operation is performed. Subforms containing sensitive data can use a higher security level.

[0064] In this implementation, the data slicing operation and hierarchical encryption method can improve the flexibility and security of data encryption. Even if one encryption method is cracked, it will not affect the use of other encryption methods and will not cause transmission failure, thereby improving the security of form data transmission.

[0065] Figure 2 This diagram illustrates another flow chart of the data transmission method in an embodiment of this application, which can be executed by the receiving end. For example... Figure 2 As shown, the method may include the following steps.

[0066] S210: Receive the first message sent by the sender.

[0067] The first message carries first encrypted data, which is data obtained by encrypting a first random number using a target verification key. The target verification key is a key negotiated with the sending end based on a first preset rule.

[0068] S220: Feedback a second message to the sending end in response to the first message.

[0069] The second message carries a second random number and encrypted verification information. The encrypted verification information is information obtained by encrypting preset verification information using a first session key. The first session key is generated based on the first random number and the second random number.

[0070] S230: When the sending end decrypts the encrypted verification information using the second session key to obtain the preset verification information, the target transmission data sent by the sending end is received.

[0071] The target transmitted data includes second encrypted data and third encrypted data. The second encrypted data is data obtained by encrypting the identifier of the target encryption algorithm using the second session key, and the third encrypted data is data obtained by encrypting the original transmitted data using the target encryption algorithm.

[0072] It should be noted that the verification process described above in S210-S230 is the same as... Figure 1 The corresponding implementation examples can be referred to. Figure 1 The descriptions of S110-S130 in the embodiments will not be repeated here.

[0073] S240: If the second encrypted data is decrypted using the first session key to obtain the identifier of the target encryption algorithm, the third encrypted data is decrypted using the target encryption algorithm to obtain the original transmission data.

[0074] Understandably, after receiving the target transmitted data, the receiving end needs to decrypt the target transmitted data. Since the second session key used by the sending end during encryption is the same as the first session key, the first session key needs to be used to decrypt the second encrypted data to obtain the identifier of the target encryption algorithm. Then, the target encryption algorithm corresponding to the identifier of the target encryption algorithm is used to decrypt the third encrypted data to obtain the original transmitted data.

[0075] In this embodiment, a first message sent by the sending end is first received, and then a second message is fed back to the sending end in response to the first message. The second message carries a second random number and encrypted verification information. The encrypted verification information is obtained by encrypting preset verification information using a first session key, which is generated based on the first and second random numbers. When the sending end decrypts the encrypted verification information using the second session key to obtain the preset verification information, the target transmission data sent by the receiving end is received. Then, the second encrypted data is decrypted using the first session key to obtain the identifier of the target encryption algorithm. Finally, the third encrypted data is decrypted using the target encryption algorithm to obtain the original transmission data. This achieves the transmission of encryption strategies based on real-time generated session keys, allowing the receiving end to quickly learn the encryption strategy and then decrypt it based on the encryption strategy. This improves the decryption speed while ensuring the security of the encryption strategy transmission. Simultaneously, through the two interactions of the verification key and the session key, secure authentication between the two ends of the data transmission is completed, ensuring both security and improving the verification speed at both ends.

[0076] In one implementation, the first preset rule includes one of the following:

[0077] (1) Determine the target verification key based on the historical session key from the last transmission.

[0078] (2) Determine the target verification key based on the historical data transmission volume between the sending end and the receiving end during the last transmission.

[0079] (3) Determine the target verification key based on the data transmission start time and / or data transmission end time between the sending end and the receiving end during the last transmission.

[0080] (4) Determine the target verification key according to the preset key change table.

[0081] (5) Determine the target verification key based on the key negotiated by the sending end and the receiving end based on the key change table at the end of the last transmission.

[0082] It should be noted that for details regarding this implementation method, please refer to [link / reference]. Figure 1 The descriptions in the embodiments will not be repeated here.

[0083] In one implementation, the second message further includes a second preset rule, wherein the second preset rule is used to represent the encryption rule of the encrypted verification information; before feeding back the second message to the sending end for the first message, the method further includes: generating the first session key based on the first random number and the second random number according to the second preset rule.

[0084] In another implementation, the second preset rule includes one of the following:

[0085] (1) When the first random number and the second random number are encrypted using the first preset key to obtain the first ciphertext, the first session key is determined based on the hash value of the first ciphertext.

[0086] (2) When the target operation result is encrypted using the second preset key to obtain the second ciphertext, the first session key is determined based on the hash value of the second ciphertext, wherein the target operation result is obtained by performing a preset operation on the first random number and the second random number.

[0087] (3) When the first random number, the second random number, the device information of the sending end, the device information of the receiving end, and the preset extended information are encrypted using a third preset key to obtain a third ciphertext, the first session key is determined based on the hash value of the third ciphertext.

[0088] It should be noted that for details regarding the above implementation methods, please refer to [link / reference needed]. Figure 1 The descriptions in the embodiments will not be repeated here.

[0089] In one implementation, the third encrypted data includes at least one encrypted form data, and the target encryption algorithm includes at least one first encryption algorithm; the step of decrypting the third encrypted data using the target encryption algorithm to obtain the original transmission data includes: decrypting each of the encrypted form data according to the corresponding first encryption algorithm to obtain the original transmission data.

[0090] It should be noted that the above decryption process is related to... Figure 1 The encryption process described in the embodiments corresponds to that described in the examples and can be referred to as follows. Figure 1 The descriptions in the embodiments will not be repeated here.

[0091] Furthermore, in one implementation, each encrypted form data includes at least one encrypted sub-form, and each first encryption algorithm includes at least one second encryption algorithm; the step of decrypting each encrypted form data according to the corresponding first encryption algorithm to obtain the original transmission data includes: for each form data, decrypting each encrypted sub-form according to the corresponding second encryption algorithm to obtain the original transmission data.

[0092] It should be noted that the above decryption process is related to... Figure 1 The encryption process described in the embodiments corresponds to that described in the examples and can be referred to as follows. Figure 1 The descriptions in the embodiments will not be repeated here.

[0093] To better illustrate the above embodiments, this application also provides an interactive schematic diagram of encrypted data transmission, such as... Figure 3 As shown, the following steps may be included:

[0094] S310: Obtain the verification key DK and random number R1.

[0095] S320: Encrypt the random number R1 using the verification key DK and send it to the receiving end.

[0096] S330: Obtain the verification key DK and decrypt it to obtain the random number R1.

[0097] S340: Generate a random number R2, and generate a session key SK based on the random numbers R1 and R2.

[0098] S350: Use SK to encrypt the pre-defined verification message and transmit the ciphertext + R2 to the sender.

[0099] S360: Based on the received R2, calculate the session key SK, decrypt the ciphertext, and if an authentication message is received, the authentication is successful; otherwise, end the transmission.

[0100] S370: Use an encryption algorithm to encrypt the data to be transmitted to obtain the transmitted ciphertext; use the session key SK to encrypt the identifier of the encryption algorithm to obtain the algorithm ciphertext.

[0101] The process may further include, prior to S370, acquiring the data to be transmitted and determining the encryption algorithm. The encryption algorithm may indeed include acquiring the form's default security level and selecting an encryption algorithm from at least one encryption algorithm under that security level, or adjusting the form's security level and selecting an encryption algorithm from at least one encryption algorithm under the adjusted security level.

[0102] S380: Send the transmission ciphertext and algorithm ciphertext to the receiving end.

[0103] S390: Decrypt to obtain the encryption algorithm identifier, and then decrypt the transmitted ciphertext according to the encryption algorithm.

[0104] It should be noted that this embodiment is capable of achieving Figures 1-2 The various processes implemented in the method embodiments shown are not described again here to avoid repetition.

[0105] Figure 4 This specification shows a schematic diagram of a data transmission device according to an embodiment, such as... Figure 4 As shown, the data transmission device 400 may include: a first transmitting module 410, a receiving module 420, and a second transmitting module 430.

[0106] In this embodiment, the first sending module 410 is used to send a first message to the receiving end, wherein the first message carries first encrypted data, which is data obtained by encrypting a first random number using a target verification key, and the target verification key is a key negotiated with the receiving end based on a first preset rule; the receiving module 420 is used to receive a second message fed back by the receiving end in response to the first message, wherein the second message carries a second random number and encrypted verification information, which is information obtained by encrypting preset verification information using a first session key, and the first session key is generated based on the first random number and the second random number; the second sending module 430 is used to send target transmission data to the receiving end after decrypting the encrypted verification information using the second session key to obtain the preset verification information, wherein the second session key is generated based on the first random number and the second random number, and the target transmission data includes second encrypted data and third encrypted data, wherein the second encrypted data is data encrypted using the second session key to encrypt the identifier of the target encryption algorithm, and the third encrypted data is data obtained by encrypting the original transmission data using the target encryption algorithm.

[0107] In one implementation, the first preset rule includes one of the following: determining the target verification key based on the historical session key from the last transmission; determining the target verification key based on the historical data transmission volume between the sender and the receiver during the last transmission; determining the target verification key based on the data transmission start time and / or data transmission end time between the sender and the receiver during the last transmission; determining the target verification key based on a preset key change table; and determining the target verification key based on the key negotiated by the sender and the receiver based on the key change table at the end of the last transmission.

[0108] In one implementation, the second message further includes a second preset rule, wherein the second preset rule is used to represent the encryption rule of the encrypted verification information; the device further includes a generation module, used to generate the second session key based on the first random number and the second random number according to the second preset rule.

[0109] In one implementation, the second preset rule includes one of the following: when encrypting the first random number and the second random number using a first preset key to obtain a first ciphertext, the second session key is determined based on the hash value of the first ciphertext; when encrypting the target operation result using a second preset key to obtain a second ciphertext, the second session key is determined based on the hash value of the second ciphertext, wherein the target operation result is the result obtained by performing a preset operation on the first random number and the second random number; when encrypting the first random number, the second random number, the device information of the sending end, the device information of the receiving end, and preset extended information using a third preset key to obtain a third ciphertext, the second session key is determined based on the hash value of the third ciphertext.

[0110] In one implementation, the apparatus further includes: a first acquisition module for acquiring the original transmission data; a second acquisition module for acquiring a target encryption algorithm that matches the original transmission data; and an encryption module for encrypting the original transmission data using the target encryption algorithm to obtain the third encrypted data.

[0111] In one implementation, the original transmitted data includes at least one form data, and the target encryption algorithm includes at least one first encryption algorithm; obtaining the target encryption algorithm matching the original transmitted data includes: determining the security level corresponding to each form data; and selecting the first encryption algorithm corresponding to each form from at least one encryption algorithm associated with the security level corresponding to each form data according to the user permissions of the current user, wherein the at least one encryption algorithm associated with each security level is determined according to a preset evaluation index, and the preset evaluation index includes at least one of the following: encryption algorithm complexity, resistance to attacks, standardization, encryption speed, and resource consumption.

[0112] In one implementation, each form data includes at least one field, and each first encryption algorithm includes at least one second encryption algorithm; the step of selecting the first encryption algorithm corresponding to each form from at least one encryption algorithm associated with the confidentiality level of each form data according to the user permissions of the current user includes: for each form data, dividing the form data into multiple sub-forms according to the sensitivity of each field, determining the confidentiality level corresponding to each sub-form, and selecting the second encryption algorithm corresponding to each sub-form from at least one encryption algorithm associated with the confidentiality level of each sub-form.

[0113] The data transmission device provided in this application embodiment can achieve... Figure 1 The various processes implemented in the method embodiments shown will not be described again here to avoid repetition.

[0114] The data transmission device in the embodiments of this application can be a device, or it can be a component, integrated circuit, or chip in an electronic device. The embodiments of this application are not specifically limited.

[0115] One data transmission device in this application embodiment can be a device with an operating system. The operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit the specific operating system.

[0116] Figure 5 This specification shows a schematic diagram of a data transmission device according to an embodiment, such as... Figure 5 As shown, the data transmission device 500 may include: a first receiving module 510, a feedback module 520, a second receiving module 530, and a decryption module 540.

[0117] In this embodiment, the first receiving module 510 is used to receive a first message sent by the sending end, wherein the first message carries first encrypted data, the first encrypted data being data obtained by encrypting a first random number using a target verification key, the target verification key being a key negotiated with the sending end based on a first preset rule; the feedback module 520 is used to feed back a second message to the sending end in response to the first message, wherein the second message carries a second random number and encrypted verification information, wherein the encrypted verification information is information obtained by encrypting preset verification information using a first session key, the first session key being generated based on the first random number and the second random number; the second receiving module 510... 30, configured to receive target transmission data sent by the receiving end when the sending end decrypts the encrypted verification information using the second session key to obtain the preset verification information, wherein the target transmission data includes second encrypted data and third encrypted data, the second encrypted data being data encrypted with the identifier of the target encryption algorithm using the second session key, and the third encrypted data being data obtained by encrypting the original transmission data using the target encryption algorithm; decryption module 540, configured to decrypt the third encrypted data using the target encryption algorithm to obtain the original transmission data when the second encrypted data is decrypted using the first session key to obtain the identifier of the target encryption algorithm.

[0118] In one implementation, the first preset rule includes one of the following: determining the target verification key based on the historical session key from the last transmission; determining the target verification key based on the historical data transmission volume between the sender and the receiver during the last transmission; determining the target verification key based on the data transmission start time and / or data transmission end time between the sender and the receiver during the last transmission; determining the target verification key based on a preset key change table; and determining the target verification key based on the key negotiated by the sender and the receiver based on the key change table at the end of the last transmission.

[0119] In one implementation, the second message further includes a second preset rule, wherein the second preset rule is used to represent the encryption rule of the encrypted verification information; the device further includes a generation module, used to generate the first session key based on the first random number and the second random number according to the second preset rule.

[0120] In one implementation, the second preset rule includes one of the following: when encrypting the first random number and the second random number using a first preset key to obtain a first ciphertext, the first session key is determined based on the hash value of the first ciphertext; when encrypting the target operation result using a second preset key to obtain a second ciphertext, the first session key is determined based on the hash value of the second ciphertext, wherein the target operation result is the result obtained by performing a preset operation on the first random number and the second random number; when encrypting the first random number, the second random number, the device information of the sending end, the device information of the receiving end, and preset extended information using a third preset key to obtain a third ciphertext, the first session key is determined based on the hash value of the third ciphertext.

[0121] In one implementation, the third encrypted data includes at least one encrypted form data, and the target encryption algorithm includes at least one first encryption algorithm; the step of decrypting the third encrypted data using the target encryption algorithm to obtain the original transmission data includes: decrypting each of the encrypted form data according to the corresponding first encryption algorithm to obtain the original transmission data.

[0122] In one implementation, each encrypted form data includes at least one encrypted sub-form, and each first encryption algorithm includes at least one second encryption algorithm; the step of decrypting each encrypted form data according to the corresponding first encryption algorithm to obtain the original transmission data includes: for each form data, decrypting each encrypted sub-form according to the corresponding second encryption algorithm to obtain the original transmission data.

[0123] The data transmission device provided in this application embodiment can achieve... Figure 2 The various processes implemented in the method embodiments shown will not be described again here to avoid repetition.

[0124] The data transmission device in the embodiments of this application can be a device, or it can be a component, integrated circuit, or chip in an electronic device. The embodiments of this application are not specifically limited.

[0125] One data transmission device in this application embodiment can be a device with an operating system. The operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit the specific operating system.

[0126] Optional, such as Figure 6As shown, this application embodiment also provides an electronic device 600, including a processor 610, a memory 620, and a program or instructions stored in the memory 620 and executable on the processor 610. When the program or instructions are executed by the processor 610, they implement the various processes of the above-described data transmission method embodiment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0127] This application also provides a computer-readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described data transmission method embodiments and achieve the same technical effects. To avoid repetition, they will not be described again here.

[0128] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0129] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above data transmission method embodiments. To avoid repetition, these will not be described again here.

[0130] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0131] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0132] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0133] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A data transmission method, characterized in that, Applied to the sending end, the method includes: Send a first message to the receiving end, wherein the first message carries first encrypted data, the first encrypted data being data obtained by encrypting a first random number using a target verification key, the target verification key being a key negotiated with the receiving end based on a first preset rule; The receiver receives a second message in response to the first message, wherein the second message carries a second random number and encrypted verification information, the encrypted verification information being information obtained by encrypting preset verification information using a first session key, and the first session key being generated based on the first random number and the second random number; When the encrypted verification information is decrypted using the second session key to obtain the preset verification information, target transmission data is sent to the receiving end. The second session key is generated based on the first random number and the second random number. The target transmission data includes second encrypted data and third encrypted data. The second encrypted data is data encrypted using the second session key with the identifier of the target encryption algorithm. The third encrypted data is data obtained by encrypting the original transmission data using the target encryption algorithm.

2. The method according to claim 1, characterized in that, The first preset rule includes one of the following: The target verification key is determined based on the historical session key from the last transmission; The target verification key is determined based on the historical data transmission volume between the sending end and the receiving end during the last transmission; The target verification key is determined based on the data transmission start time and / or data transmission end time between the sending end and the receiving end during the last transmission. The target verification key is determined according to a preset key change table; The target verification key is determined based on the key negotiated by the sending end and the receiving end based on the key change table at the end of the last transmission.

3. The method according to claim 1, characterized in that, The second message also includes a second preset rule, wherein the second preset rule is used to represent the encryption rule of the encrypted verification information; Before sending the target transmission data to the receiving end, the method further includes: generating the second session key based on the first random number and the second random number according to the second preset rule.

4. The method according to claim 3, characterized in that, The second preset rule includes one of the following: When the first random number and the second random number are encrypted using the first preset key to obtain the first ciphertext, the second session key is determined based on the hash value of the first ciphertext; When the target operation result is encrypted using a second preset key to obtain a second ciphertext, the second session key is determined based on the hash value of the second ciphertext, wherein the target operation result is obtained by performing a preset operation on the first random number and the second random number; When the first random number, the second random number, the device information of the sending end, the device information of the receiving end, and the preset extended information are encrypted using a third preset key to obtain a third ciphertext, the second session key is determined based on the hash value of the third ciphertext.

5. The method according to claim 1, characterized in that, Before sending the target transmission data to the receiving end, the method further includes: Obtain the original transmission data; Obtain the target encryption algorithm that matches the original transmitted data; The original transmitted data is encrypted using the target encryption algorithm to obtain the third encrypted data.

6. The method according to claim 5, characterized in that, The original transmitted data includes at least one form data, and the target encryption algorithm includes at least one first encryption algorithm; The step of obtaining the target encryption algorithm that matches the original transmitted data includes: Determine the confidentiality level for each piece of form data; According to the user permissions of the current user, the first encryption algorithm corresponding to each form is selected from at least one encryption algorithm associated with the confidentiality level of each form data. The at least one encryption algorithm associated with each confidentiality level is determined according to preset evaluation indicators, which include at least one of the following: encryption algorithm complexity, resistance to attacks, standardization, encryption speed, and resource consumption.

7. The method according to claim 6, characterized in that, Each of the form data includes at least one field, and each of the first encryption algorithms includes at least one second encryption algorithm; The step of selecting the first encryption algorithm corresponding to each form from at least one encryption algorithm associated with the confidentiality level of each form data according to the user permissions of the current user includes: For each form data, the form data is divided into multiple sub-forms according to the sensitivity of each field. The confidentiality level corresponding to each sub-form is determined, and the second encryption algorithm corresponding to each sub-form is selected from at least one encryption algorithm associated with the confidentiality level of each sub-form.

8. A data transmission method, characterized in that, Applied to the receiving end, the method includes: The system receives a first message sent by a sending end, wherein the first message carries first encrypted data, the first encrypted data being data obtained by encrypting a first random number using a target verification key, and the target verification key being a key negotiated with the sending end based on a first preset rule; In response to the first message, a second message is sent back to the sending end, wherein the second message carries a second random number and encrypted verification information, wherein the encrypted verification information is information obtained by encrypting preset verification information using a first session key, and the first session key is generated based on the first random number and the second random number; When the sending end decrypts the encrypted verification information using the second session key to obtain the preset verification information, the target transmission data sent by the sending end is received. The target transmission data includes second encrypted data and third encrypted data. The second encrypted data is data encrypted using the second session key to encrypt the identifier of the target encryption algorithm. The third encrypted data is data obtained by encrypting the original transmission data using the target encryption algorithm. If the second encrypted data is decrypted using the first session key to obtain the identifier of the target encryption algorithm, the third encrypted data is then decrypted using the target encryption algorithm to obtain the original transmission data.

9. The method according to claim 8, characterized in that, The first preset rule includes one of the following: The target verification key is determined based on the historical session key from the last transmission; The target verification key is determined based on the historical data transmission volume between the sending end and the receiving end during the last transmission; The target verification key is determined based on the data transmission start time and / or data transmission end time between the sending end and the receiving end during the last transmission. The target verification key is determined according to a preset key change table; The target verification key is determined based on the key negotiated by the sending end and the receiving end based on the key change table at the end of the last transmission.

10. The method according to claim 8, characterized in that, The second message also includes a second preset rule, wherein the second preset rule is used to represent the encryption rule of the encrypted verification information; Before sending a second message to the sending end in response to the first message, the method further includes: generating the first session key based on the first random number and the second random number according to the second preset rule.

11. The method according to claim 10, characterized in that, The second preset rule includes one of the following: When the first random number and the second random number are encrypted using the first preset key to obtain the first ciphertext, the first session key is determined based on the hash value of the first ciphertext. When the target operation result is encrypted using a second preset key to obtain a second ciphertext, the first session key is determined based on the hash value of the second ciphertext, wherein the target operation result is obtained by performing a preset operation on the first random number and the second random number; When a third ciphertext is obtained by encrypting the first random number, the second random number, the device information of the sending end, the device information of the receiving end, and the preset extended information using a third preset key, the first session key is determined based on the hash value of the third ciphertext.

12. The method according to claim 8, characterized in that, The third encrypted data includes at least one encrypted form data, and the target encryption algorithm includes at least one first encryption algorithm; The process of decrypting the third encrypted data using the target encryption algorithm to obtain the original transmitted data includes: Each encrypted form data is decrypted according to the corresponding first encryption algorithm to obtain the original transmitted data.

13. The method according to claim 12, characterized in that, Each encrypted form data includes at least one encrypted sub-form, and each first encryption algorithm includes at least one second encryption algorithm; The step of decrypting each encrypted form data according to the corresponding first encryption algorithm to obtain the original transmitted data includes: For each form data, each encrypted sub-form is decrypted according to the corresponding second encryption algorithm to obtain the original transmitted data.

14. A data transmission device, characterized in that, include: A first sending module is configured to send a first message to a receiving end, wherein the first message carries first encrypted data, the first encrypted data being data obtained by encrypting a first random number using a target verification key, and the target verification key being a key negotiated with the receiving end based on a first preset rule; The receiving module is configured to receive a second message fed back by the receiving end in response to the first message, wherein the second message carries a second random number and encrypted verification information, the encrypted verification information being information obtained by encrypting preset verification information using a first session key, and the first session key being generated based on the first random number and the second random number; The second sending module is used to send target transmission data to the receiving end after decrypting the encrypted verification information with the second session key to obtain the preset verification information. The second session key is generated based on the first random number and the second random number. The target transmission data includes second encrypted data and third encrypted data. The second encrypted data is data after encrypting the identifier of the target encryption algorithm with the second session key. The third encrypted data is data obtained by encrypting the original transmission data with the target encryption algorithm.

15. A data transmission device, characterized in that, include: The first receiving module is configured to receive a first message sent by the sending end, wherein the first message carries first encrypted data, the first encrypted data being data obtained by encrypting a first random number using a target verification key, and the target verification key being a key negotiated with the sending end based on a first preset rule; The feedback module is used to send a second message to the sending end in response to the first message, wherein the second message carries a second random number and encrypted verification information, wherein the encrypted verification information is information obtained by encrypting preset verification information using a first session key, and the first session key is generated based on the first random number and the second random number; The second receiving module is configured to receive target transmission data sent by the sending end when the sending end decrypts the encrypted verification information using the second session key to obtain the preset verification information. The target transmission data includes second encrypted data and third encrypted data. The second encrypted data is data encrypted using the second session key to encrypt the identifier of the target encryption algorithm, and the third encrypted data is data obtained by encrypting the original transmission data using the target encryption algorithm. The decryption module is used to decrypt the third encrypted data using the target encryption algorithm after decrypting the second encrypted data with the first session key to obtain the identifier of the target encryption algorithm, thereby obtaining the original transmission data.

16. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the data transmission method as described in any one of claims 1-13.

17. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the data transmission method as described in any one of claims 1-13.

18. A computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions that, when executed by a computer, cause the computer to perform the steps of the data transmission method as described in any one of claims 1-13.

Images