Data transmission method, apparatus and electronic device
By dynamically generating encryption keys and employing multi-layered encryption strategies, the data security risks associated with using fixed keys in existing technologies are resolved, achieving high security and uniqueness in data transmission.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-07-25
- Publication Date
- 2026-04-07
Smart Images
Figure CN118802143B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data transmission technology, and in particular to a data transmission method, apparatus and electronic device. Background Technology
[0002] With the rapid development of the big data era, data has become an indispensable core resource for enterprise operations, scientific research, and daily life. However, data security issues during transmission are becoming increasingly prominent, posing a significant bottleneck to fully realizing the value of data. Data breaches can not only lead to the infringement of personal privacy but also the leakage of corporate trade secrets, resulting in substantial economic losses and reputational damage.
[0003] To ensure data security during transmission, the commonly used technical method is to encrypt the data before transmission. This encrypted transmission method improves data transmission security to a certain extent and effectively prevents unauthorized third parties from directly reading the data during transmission.
[0004] However, in existing encrypted transmission schemes, once the two communicating parties have determined the encryption and decryption keys, they are used to encrypt and decrypt data in every transmission. Although this static key management mechanism simplifies the complexity of key management, once the key is illegally stolen or leaked, even if the transmitted data is encrypted, attackers can easily use the key to parse the data content, thus significantly increasing the risk to data security. Summary of the Invention
[0005] In view of this, this application provides a data transmission method, apparatus, and electronic device, the main purpose of which is to solve the technical problem that the same encryption and decryption key is used to encrypt and decrypt data in every transmission process, which leads to a significant increase in data security risks.
[0006] According to a first aspect of this disclosure, a data transmission method is provided, applied to the sending end side for execution, comprising:
[0007] Generate a random number, and generate a first encryption key based on the random number;
[0008] The target request data is encrypted using the first encryption key to obtain encrypted data;
[0009] The second encryption key is determined based on the elliptic curve, and the first encryption key is encrypted using the second encryption key to obtain the encrypted ciphertext.
[0010] The encrypted data and the encrypted ciphertext are encrypted using the first target public key of the receiving end, and the encrypted data and the encrypted ciphertext are transmitted to the receiving end. The receiving end then uses the first target private key corresponding to the first target public key to decrypt the encrypted data and the encrypted ciphertext to obtain the encrypted data and the encrypted ciphertext. The encrypted ciphertext is then decrypted to obtain a first decryption key. The encrypted data is then decrypted using the first decryption key to obtain the target request data.
[0011] According to a second aspect of this disclosure, a data transmission method is provided, applied to the receiving end side for execution, comprising:
[0012] Receive encrypted data and encrypted ciphertext sent by the sender using the first target public key;
[0013] The encrypted data and the encrypted ciphertext are decrypted using the first target private key corresponding to the first target public key to obtain the encrypted data and the encrypted ciphertext.
[0014] The encrypted ciphertext is decrypted using an elliptic curve cryptography algorithm to obtain the first decryption key;
[0015] The encrypted data is decrypted using the first decryption key to obtain the target request data.
[0016] According to a third aspect of this disclosure, a data transmission apparatus is provided, applied at the transmitting end, comprising:
[0017] The generation module is used to generate random numbers and generate a first encryption key based on the random numbers;
[0018] The first encryption module is used to encrypt the target request data using the first encryption key to obtain encrypted data;
[0019] The second encryption module is used to determine the second encryption key based on an elliptic curve, utilizing the...
[0020] The second encryption key is used to encrypt the first encryption key to obtain encrypted ciphertext;
[0021] The third encryption module is used to encrypt the encrypted data and the encrypted ciphertext using the first target public key of the receiving end, and transmit the encrypted data and the encrypted ciphertext to the receiving end, so that the receiving end can decrypt the encrypted data and the encrypted ciphertext using the first target private key corresponding to the first target public key to obtain the encrypted data and the encrypted ciphertext; decrypt the encrypted ciphertext to obtain a first decryption key; and use the first decryption key to decrypt the encrypted data to obtain the target request data.
[0022] According to a fourth aspect of this disclosure, a data transmission apparatus is provided, applied at a receiving end, comprising:
[0023] The second receiving module is used to receive encrypted data and encrypted ciphertext sent by the sending end, which are encrypted with the first target public key;
[0024] The second decryption module is used to decrypt the encrypted data and the encrypted ciphertext using the first target private key corresponding to the first target public key, so as to obtain the encrypted data and the encrypted ciphertext.
[0025] The third decryption module is used to decrypt the encrypted ciphertext based on the elliptic curve encryption algorithm to obtain the first decryption key;
[0026] The fourth decryption module is used to decrypt the encrypted data using the first decryption key to obtain the target request data.
[0027] According to a fifth aspect of this disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method of the first aspect described above, or to perform the method of the second aspect described above.
[0028] According to a sixth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are configured to cause a computer to perform the method of the first aspect or to perform the method of the second aspect.
[0029] According to a seventh aspect of this disclosure, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method of the first aspect or the method of the second aspect.
[0030] Compared with the prior art, the data transmission method, apparatus, and electronic device provided in this disclosure generate random numbers and generate a first encryption key based on the random numbers; encrypt the target request data using the first encryption key to obtain encrypted data; determine a second encryption key based on elliptic curves and encrypt the first encryption key using the second encryption key to obtain encrypted ciphertext; encrypt the encrypted data and encrypted ciphertext using the first target public key of the receiving end, and transmit the encrypted data and encrypted ciphertext to the receiving end, so that the receiving end can decrypt the encrypted data and encrypted ciphertext using the first target private key corresponding to the first target public key; decrypt the encrypted ciphertext to obtain a first decryption key; and decrypt the encrypted data using the first decryption key to obtain the target request data. By applying the technical solution of this disclosure and introducing a dynamic key management mechanism, i.e., generating random numbers and generating a first encryption key based on the random numbers, it ensures that the encryption key used for each transmission is unique, thereby avoiding the security risks that may be caused by using a fixed key. By introducing a multi-layered encryption strategy, the first layer of encryption encrypts the target request data using a first encryption key, ensuring basic data security during transmission. The second layer uses an elliptic curve algorithm to determine a second encryption key, which is then used to encrypt the first encryption key, resulting in encrypted ciphertext, providing additional security protection for the first encryption key. The third layer uses the receiving end's first target public key to encrypt both the encrypted data and the encrypted ciphertext again, before transmitting the entire encrypted data to the receiving end. By leveraging the security of public-key encryption, even if the encrypted data and ciphertext are intercepted during transmission, they cannot be decrypted without the corresponding private key, significantly reducing data security risks.
[0031] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description
[0032] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0033] To more clearly illustrate the technical applications in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0034] Figure 1 This is a schematic flowchart illustrating a data transmission method provided in an embodiment of this disclosure;
[0035] Figure 2 This is a schematic flowchart illustrating another data transmission method provided in an embodiment of this disclosure;
[0036] Figure 3 This is a schematic diagram of the structure of a data transmission device provided in an embodiment of the present disclosure;
[0037] Figure 4 This is a schematic diagram of another data transmission device provided in an embodiment of the present disclosure. Detailed Implementation
[0038] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding. These should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description. It should be noted that, unless otherwise specified, the embodiments of this disclosure and the features described therein can be combined with each other.
[0039] The data transmission method, apparatus, and electronic device of this disclosure are described below with reference to the accompanying drawings.
[0040] This disclosure provides a data transmission method, apparatus, and electronic device, the main purpose of which is to solve the technical problem that the same encryption and decryption key is used to encrypt and decrypt data in every transmission process, which leads to a significant increase in data security risks.
[0041] like Figure 1 As shown, embodiments of this disclosure provide a data transmission method, applied to the sending end side for execution, wherein the method may include:
[0042] Step 101: Generate a random number and generate the first encryption key based on the random number.
[0043] The random number can be a number randomly generated each time data is transmitted, in order to ensure the uniqueness of the first encryption key used in each data transmission.
[0044] The first encryption key can be a key generated based on random numbers and used to encrypt the target request data during data transmission. Due to the unpredictability of random numbers, the first encryption key generated based on random numbers also has a high degree of security, making it more difficult for attackers to access or tamper with the transmitted data by cracking the key.
[0045] In this embodiment of the disclosure, the system can randomly generate a random number before each data transmission. A unique encryption key for this data transmission can be generated using an algorithm (such as a key derivation function KDF). This ensures that a different key is used for each transmission, significantly reducing the risk of mass decryption of data if the key is stolen.
[0046] For embodiments of this disclosure, before generating a random number and generating a first encryption key based on the random number, the method further includes:
[0047] Receive data transmission requests sent by the receiving end that are encrypted using the second target public key of the sending end;
[0048] The encrypted data transmission request is decrypted using the private key of the second target corresponding to the public key of the second target, and the data transmission request includes user authentication information, the IP address of the receiving end, and data identifier.
[0049] Verify user authentication information;
[0050] If the verification passes, a random number is generated, and the first encryption key is generated based on the random number.
[0051] If the verification fails, an authentication failure message is sent to the receiving end.
[0052] In specific application scenarios, for ease of description, the following example illustrates the implementation process of this application by taking user A requesting data A (i.e., the target requested data) stored on terminal B (i.e., the data sender) through terminal A (i.e., the data receiver).
[0053] User A sends a data transmission request from terminal A (as the data receiver) to terminal B (as the data sender). The request content may include user authentication information, the receiver's IP address, and a data identifier.
[0054] User authentication information can be used to verify the identity and permissions of user A, ensuring that only legitimate users can request data. User authentication information may include, but is not limited to, username, password, and other forms of authentication tokens or certificates.
[0055] The receiving end's IP address (i.e., the IP address of terminal A) can be used as the sending address of terminal B (i.e., the data sending end).
[0056] A data identifier (i.e., the identifier for data A) can be used to clearly specify the specific data being requested, avoiding the sending of incorrect data. A data identifier can be a filename, a database record ID, or other information that can uniquely identify the data.
[0057] To ensure the security of data transmission requests during transmission and prevent them from being stolen or tampered with by unauthorized third parties, data transmission requests are encrypted using the public key of terminal B (i.e., the data sender) (i.e., the second target public key).
[0058] Public-key encryption is an asymmetric encryption method where the public key is publicly available, but the private key is only held by terminal B (i.e., the data sender). Data encrypted with the public key can only be decrypted with the corresponding private key, thus ensuring the security of data transmission.
[0059] Specifically, before sending a data transmission request, terminal A (i.e., the data receiver) can use the public key of terminal B (i.e., the data sender) (i.e., the second target public key) to encrypt sensitive information (such as user authentication information, receiver IP address and / or data identifier) in the data transmission request. The encrypted data transmission request can become seemingly random gibberish, and only the second target private key corresponding to the second target public key can decrypt and restore the original information.
[0060] When terminal B (i.e., the data sender) receives a data transmission request from terminal A (i.e., the data receiver), it can first parse the data transmission request to extract user authentication information, receiver IP address, and data identifier from the data transmission request.
[0061] Terminal B (i.e., the data sender) can use a preset authentication mechanism (such as database query, password hash comparison, etc.) to verify the user authentication information provided by user A, in order to confirm user A's identity and permissions, and ensure that user A is qualified to request data A.
[0062] If user A's authentication information passes verification, it means that user A's identity and permissions are legitimate, and user A has the right to request data A. At this point, terminal B will perform subsequent data processing steps, such as generating a random number and generating the first encryption key based on the random number.
[0063] If user A's authentication information fails verification, it indicates a problem with user A's identity or permissions; user A does not have sufficient authorization to request data A. In this case, terminal B can send an authentication failure message to terminal A. The authentication failure message may include an error code or description so that user A understands why the request was rejected and can guide user A to obtain the necessary data access permissions before resubmitting the request.
[0064] For the embodiments of this disclosure, verifying user authentication information may specifically include:
[0065] Blockchain is used to verify user authentication information, whereby the blockchain is used to store user authentication records;
[0066] If the blockchain does not store a user authentication record that matches the user authentication information, the verification will fail.
[0067] If the blockchain stores a user authentication record that matches the user authentication information, then obtain the user's access permissions and, based on the user's access permissions, obtain the access permissions for the target requested data.
[0068] Compare user access permissions and the permissions granted to them;
[0069] If the user's access permissions are greater than or equal to the access permissions granted, then the verification is successful.
[0070] If the user's access permissions are less than those of the user being granted, then the verification will fail.
[0071] In a specific application scenario, when user A registers, their username, password, and assigned data access permissions are stored on the blockchain. The immutability and decentralized nature of the blockchain ensure the security and trustworthiness of this information.
[0072] When terminal B (i.e., the data sender) authenticates user A's user authentication information, it sends user A's authentication information (username and password) to the blockchain network for verification. If the blockchain stores content that matches the user authentication information provided by user A, then the blockchain can provide user A with data access permission. If no matching content is found, a data verification failure message is returned.
[0073] If terminal B (i.e., the data sender) receives a verification failure message, it confirms that user A's authentication has failed and sends the authentication failure information back to terminal A (i.e., the data receiver).
[0074] If the verification is successful, terminal B (i.e., the data sender) can obtain the access permissions for data A. The access permissions can be set by the data owner (such as user A or other users) when data A is generated, indicating what types of users with access permissions can access the data.
[0075] Terminal B (i.e., the data sender) can compare the data access permissions received from the blockchain from user A with the access permissions granted to data A. If the received data access permissions are not lower than the access permissions granted to data A, then terminal B (i.e., the data sender) can confirm that user A has the permission to request the data and continue to execute subsequent steps.
[0076] If the access permissions of the received data are lower than those of the user, terminal B (i.e., the data sender) can confirm that user A's authentication has failed (although user A's identity may be real, their permissions are insufficient to access data A), and send the authentication failure information back to terminal A.
[0077] For embodiments of this disclosure, generating the first encryption key based on a random number may specifically include:
[0078] Obtain the IP address of the receiving end and the number of nodes on the transmission path between the sending and receiving ends;
[0079] The perturbation code is obtained by multiplying the random number by the number of nodes.
[0080] Perform hash operations on the scrambling code and the receiver's IP address respectively to obtain the first hash value and the second hash value;
[0081] The sum of the first hash value and the second hash value is used to determine the first encryption key.
[0082] In this application, the encryption cipher is not a pre-set fixed value, but is generated in real time based on dynamically changing factors. These factors may include the receiver's IP address, the number of nodes along the transmission path between the sender and receiver, etc. This mechanism ensures that the encryption cipher used for each data transmission is unique.
[0083] Because the IP address used for each terminal transmission is different, even if the same IP address is used for two transmissions, different terminals (e.g., using different devices or network configurations) may result in different encryption passwords.
[0084] Alternatively, changes in the current network conditions may cause changes in the transmission path between terminal A and terminal B, which in turn may result in different numbers of nodes in the selected transmission path each time. This would mean that the encryption password used for each transmission is different, or that the encryption password used for each transmission is irregular. If the encryption password is stolen in a certain case, the probability of successfully restoring the original data using the same encryption password after obtaining the encrypted data is extremely small, thus ensuring the final data security.
[0085] Compared to existing solutions, the encryption password generation mechanism of this application has significant advantages. Existing solutions typically use fixed encryption passwords, which, once stolen, pose a risk of being decrypted for all subsequent encrypted data. This application, however, introduces dynamic factors to generate encryption passwords, effectively avoiding this security vulnerability, thereby improving the security of data transmission and reducing the security risks caused by stolen encryption passwords.
[0086] Specifically, before starting the encryption process, user B first generates a random number R, which can be used to increase the complexity and security of the encryption process.
[0087] User B can obtain the IP address of terminal A. AAn IP address serves as a unique identifier for a device on a network, ensuring the specificity of encrypted passwords. The number of nodes N along the transmission path can be obtained, where the transmission path refers to the path taken by terminal A to terminal B when sending a data transmission request and ultimately transmitting data A. During connection establishment (such as a TCP connection), terminal A and terminal B exchange handshake data. Routing information can determine the number of nodes N along the path between them. The number of nodes N includes terminal A and terminal B themselves.
[0088] User B can multiply the random number R by the number of nodes N to obtain the perturbation code D, i.e.
[0089] D = R * N
[0090] Finally, user B tested the IP address. A The perturbation code D is hashed separately, and the two hash values are added together to obtain the symmetric key encryption key1 (i.e., the first encryption key). The hash operation can be a one-way function, capable of converting an input of arbitrary length into a fixed-length output, and it is difficult to deduce the input from the output. This is achieved by combining IP... A With the hash value of D, key1 becomes a complex password that contains both device identifier and network topology information.
[0091] Correspondingly, symmetric key encryption cryptography
[0092] In addition, as another possible implementation method, IP address A It can also be replaced with a MAC address to provide another form of unique device identification.
[0093] The number of nodes N can be replaced by the size of the currently transmitted data packet. However, to achieve this, the data packet size can be transmitted to terminal B in a secure manner (such as by encrypting it with terminal B's public key) so that terminal B can generate the same encryption key.
[0094] The entire process ensures that the encryption cipher used for each data transmission is generated based on multiple dynamic factors, including random numbers, IP addresses (or MAC addresses), network topology (represented by the number of nodes), and optional packet size. This design makes the encryption cipher highly unpredictable, thereby improving data transmission security.
[0095] Step 102: Use the first encryption key to encrypt the target request data to obtain encrypted data.
[0096] In this embodiment of the disclosure, after terminal B obtains data A, it can encrypt data A (i.e., target request data) based on key1 (i.e., the first encryption key) to obtain encrypted data data1.
[0097] Step 103: Determine the second encryption key based on the elliptic curve, and use the second encryption key to encrypt the first encryption key to obtain the encrypted ciphertext.
[0098] For embodiments of this disclosure, an elliptic curve E(a,b) can first be determined, where a can be the sum of the distances from any point on the ellipse to the two foci and 2. c can be the distance between the two foci of the ellipse / 2.
[0099] It can randomly determine any point No on the elliptic curve, as well as a large prime number or prime number P and a random number k.
[0100] Where P can be a large prime number or a prime number. The larger the value of P, the more difficult it is to crack. Therefore, a large prime number can be selected.
[0101] A prime number is a natural number greater than 1 that has no factors other than 1 and itself.
[0102] Large prime numbers refer to very large prime numbers. In cryptography and information security, large prime numbers are often used as modulo numbers to ensure that operations are performed within a finite field, thereby enhancing security.
[0103] A symmetric encryption key (i.e., a second encryption key) can be generated based on elliptic curves, as shown in the following formula:
[0104] key2 = PNo
[0105] Accordingly, determining the second encryption key based on elliptic curves can specifically include:
[0106] Determine any random point, prime number, and random number on an elliptic curve;
[0107] The second encryption key is determined based on random points, prime numbers, and random numbers.
[0108] The encryption process of key1 (the first encryption key) is performed using key2 (the second encryption key) to obtain the encrypted ciphertext data2 = {kNo, key1 + kkey2}.
[0109] Using data2, No, k, P, and data1 as the final data, the final data is encrypted using the public key of terminal A to obtain the data to be transmitted.
[0110] Step 104: Encrypt the encrypted data and ciphertext using the first target public key of the receiving end, and transmit the encrypted data and ciphertext to the receiving end so that the receiving end can decrypt the encrypted data and ciphertext using the first target private key corresponding to the first target public key to obtain the encrypted data and ciphertext; decrypt the ciphertext to obtain the first decryption key; and use the first decryption key to decrypt the encrypted data to obtain the target request data.
[0111] The first target public key can be the public key used by the receiving end to decrypt data or verify digital signatures.
[0112] In this embodiment of the disclosure, the first target public key of the receiving end can be used to encrypt the encrypted data and encrypted ciphertext, and the encrypted data and encrypted ciphertext can be transmitted to the receiving end, so that the receiving end can use the first target private key corresponding to the first target public key to decrypt the encrypted data and encrypted ciphertext to obtain the encrypted data and encrypted ciphertext; decrypt the encrypted ciphertext to obtain the first decryption key; and use the first decryption key to decrypt the encrypted data to obtain the target request data.
[0113] Specifically, following step 103 of the embodiment, data2, No, k, P and data1 can be used as the final data. The final data can be encrypted using the public key of terminal A to obtain the data to be transmitted, so that terminal B can transmit the data to be transmitted to terminal A.
[0114] Accordingly, the first target public key of the receiving end is used to encrypt the encrypted data and encrypted ciphertext, and the encrypted data and encrypted ciphertext are transmitted to the receiving end, including:
[0115] The first target public key of the receiving end is used to encrypt the encrypted data, encrypted ciphertext, random points, prime numbers and random numbers, and the encrypted data, encrypted ciphertext, random points, prime numbers and random numbers are transmitted to the receiving end.
[0116] In summary, the data transmission method provided in this disclosure, compared with the prior art, involves generating random numbers, generating a first encryption key based on the random numbers, encrypting the target request data using the first encryption key to obtain encrypted data, determining a second encryption key based on elliptic curves, encrypting the first encryption key using the second encryption key to obtain encrypted ciphertext, encrypting both the encrypted data and the encrypted ciphertext using the first target public key of the receiving end, and transmitting the encrypted data and ciphertext to the receiving end. The receiving end then decrypts the encrypted data and ciphertext using the first target private key corresponding to the first target public key, obtaining the encrypted data and encrypted ciphertext. The encrypted ciphertext is then decrypted to obtain a first decryption key. Finally, the encrypted data is decrypted using the first decryption key to obtain the target request data. By applying the technical solution of this disclosure and introducing a dynamic key management mechanism—that is, generating random numbers and generating a first encryption key based on the random numbers—it ensures that the encryption key used for each transmission is unique, thereby avoiding the security risks that may result from using a fixed key. By introducing a multi-layered encryption strategy, the first layer of encryption encrypts the target request data using a first encryption key, ensuring basic data security during transmission. The second layer uses an elliptic curve algorithm to determine a second encryption key, which is then used to encrypt the first encryption key, resulting in encrypted ciphertext, providing additional security protection for the first encryption key. The third layer uses the receiving end's first target public key to encrypt both the encrypted data and the encrypted ciphertext again, before transmitting the entire encrypted data to the receiving end. By leveraging the security of public-key encryption, even if the encrypted data and ciphertext are intercepted during transmission, they cannot be decrypted without the corresponding private key, significantly reducing data security risks.
[0117] The above embodiments describe the data transmission process on the sending end side. Furthermore, to fully illustrate the implementation of this embodiment, another data transmission method is provided, which can be applied to the receiving end side. For example... Figure 2 As shown, the method includes:
[0118] Step 201: Receive the encrypted data and encrypted ciphertext sent by the sender, which are encrypted with the first target public key.
[0119] The first target public key can be the public key used by the receiving end to decrypt data or verify digital signatures.
[0120] In this embodiment of the disclosure, the receiving end can receive encrypted data (i.e., data1), encrypted ciphertext (i.e., data2), random point (i.e., No), prime number (i.e., P), and random number (i.e., k) sent by the sending end and encrypted with the first target public key.
[0121] Before receiving the encrypted data, ciphertext, random points, prime numbers, and random numbers encrypted with the first target public key sent by the sending end, the method further includes:
[0122] Obtain a data transmission request, which may include user authentication information, the receiving end's IP address, and a data identifier;
[0123] The data transmission request is encrypted using the second target public key of the sending end to obtain the encrypted data transmission request.
[0124] An encrypted data transmission request is sent to the sending end, so that the sending end can decrypt the encrypted data transmission request using the private key of the second target corresponding to the public key of the second target, and obtain the decrypted data transmission request.
[0125] This method ensures the confidentiality and integrity of data during transmission, while preventing unauthorized access.
[0126] Step 202: Use the first target private key corresponding to the first target public key to decrypt the encrypted data and encrypted ciphertext to obtain the encrypted data and encrypted ciphertext.
[0127] In this embodiment of the disclosure, terminal A (i.e., the data receiving end) can use the first target private key corresponding to the first target public key to decrypt the encrypted data (i.e., data1), encrypted ciphertext (i.e., data2), random point (i.e., No), prime number (i.e., P), and random number (i.e., k) to obtain the encrypted data (i.e., data1), encrypted ciphertext (i.e., data2), random point (i.e., No), prime number (i.e., P), and random number (i.e., k).
[0128] Step 203: Decrypt the encrypted ciphertext using the elliptic curve cryptography algorithm to obtain the first decryption key.
[0129] In this embodiment of the disclosure, terminal A (i.e., the data receiving end) can decrypt the encrypted ciphertext (i.e., data2) using a random point (i.e., No), a prime number (i.e., P), and a random number (i.e., k) according to the following formula to obtain the first decryption key key1.
[0130] key1+kkey2-P(kNo)=key1+P(kNo)-P(kNo)=key1
[0131] Step 204: Use the first decryption key to decrypt the encrypted data to obtain the target request data.
[0132] In this embodiment of the disclosure, terminal A (i.e., the data receiving end) can use the first decryption key key1 to decrypt the encrypted data (i.e., data1) to obtain the target request data (i.e., data A).
[0133] In summary, the data transmission method provided in this disclosure, compared with the prior art, involves generating random numbers, generating a first encryption key based on the random numbers, encrypting the target request data using the first encryption key to obtain encrypted data, determining a second encryption key based on elliptic curves, encrypting the first encryption key using the second encryption key to obtain encrypted ciphertext, encrypting both the encrypted data and the encrypted ciphertext using the first target public key of the receiving end, and transmitting the encrypted data and ciphertext to the receiving end. The receiving end then decrypts the encrypted data and ciphertext using the first target private key corresponding to the first target public key, obtaining the encrypted data and encrypted ciphertext. The encrypted ciphertext is then decrypted to obtain a first decryption key. Finally, the encrypted data is decrypted using the first decryption key to obtain the target request data. By applying the technical solution of this disclosure and introducing a dynamic key management mechanism—that is, generating random numbers and generating a first encryption key based on the random numbers—it ensures that the encryption key used for each transmission is unique, thereby avoiding the security risks that may result from using a fixed key. By introducing a multi-layered encryption strategy, the first layer of encryption encrypts the target request data using a first encryption key, ensuring basic data security during transmission. The second layer uses an elliptic curve algorithm to determine a second encryption key, which is then used to encrypt the first encryption key, resulting in encrypted ciphertext, providing additional security protection for the first encryption key. The third layer uses the receiving end's first target public key to encrypt both the encrypted data and the encrypted ciphertext again, before transmitting the entire encrypted data to the receiving end. By leveraging the security of public-key encryption, even if the encrypted data and ciphertext are intercepted during transmission, they cannot be decrypted without the corresponding private key, significantly reducing data security risks.
[0134] Based on the above Figure 1 The specific implementation of the method shown in this embodiment provides a data transmission device that can be applied to the sending end side, such as... Figure 3 As shown, the device includes: a generation module 31, a first encryption module 32, a second encryption module 33, and a third encryption module 34;
[0135] Generation module 31 is used to generate random numbers and generate a first encryption key based on the random numbers;
[0136] The first encryption module 32 is used to encrypt the target request data using the first encryption key to obtain encrypted data;
[0137] The second encryption module 33 is used to determine the second encryption key based on the elliptic curve, and to encrypt the first encryption key using the second encryption key to obtain encrypted ciphertext.
[0138] The third encryption module 34 is used to encrypt the encrypted data and the encrypted ciphertext using the first target public key of the receiving end, and transmit the encrypted data and the encrypted ciphertext to the receiving end, so that the receiving end can decrypt the encrypted data and the encrypted ciphertext using the first target private key corresponding to the first target public key to obtain the encrypted data and the encrypted ciphertext; decrypt the encrypted ciphertext to obtain a first decryption key; and use the first decryption key to decrypt the encrypted data to obtain the target request data.
[0139] In specific application scenarios, such as Figure 3 As shown, the device also includes: a first receiving module 35, a first decryption module 36, and a verification module 37;
[0140] The first receiving module 35 is used to receive a data transmission request sent by the receiving end, which is encrypted using the second target public key of the sending end;
[0141] The first decryption module 36 is used to decrypt the encrypted data transmission request using the second target private key corresponding to the second target public key, and obtain the decrypted data transmission request, which includes user authentication information, receiving end IP address and data identifier.
[0142] The verification module 37 is used to verify the user authentication information; if the verification is successful, a random number is generated, and a first encryption key is generated based on the random number; if the verification fails, authentication failure information is sent to the receiving end.
[0143] In specific application scenarios, the verification module 37 can be used to verify the user authentication information using blockchain, wherein the blockchain is used to store user authentication records;
[0144] If the blockchain does not store a user authentication record that matches the user authentication information, the verification fails.
[0145] If the blockchain stores a user authentication record that matches the user authentication information, then user access permissions are obtained, and access permissions for the target request data are obtained based on the user access permissions.
[0146] Compare the user's access permissions with the access permissions being granted; if the user's access permissions are greater than or equal to the access permissions being granted, the verification is deemed successful; if the user's access permissions are less than the access permissions being granted, the verification is deemed unsuccessful.
[0147] In specific application scenarios, the generation module 31 can be used to obtain the IP address of the receiving end and the number of nodes on the transmission path between the sending end and the receiving end.
[0148] The random number is multiplied by the number of nodes to obtain the perturbation code;
[0149] Perform hash operations on the perturbation code and the receiving end IP address respectively to obtain a first hash value and a second hash value;
[0150] The sum of the first hash value and the second hash value is determined as the first encryption key.
[0151] In specific application scenarios, the second encryption module 33 can be used to determine any random point, prime number, and random number of the elliptic curve;
[0152] The second encryption key is determined based on the random point, the prime number, and the random number.
[0153] In a specific application scenario, the third encryption module 34 can be used to encrypt the encrypted data, the encrypted ciphertext, the random point, the prime number and the random number using the first target public key of the receiving end, and transmit the encrypted encrypted data, the encrypted ciphertext, the random point, the prime number and the random number to the receiving end.
[0154] It should be noted that other corresponding descriptions of the functional units involved in the data transmission device applicable to the transmitting end side provided in this embodiment can be found in the following references. Figure 1 The corresponding descriptions of the Chinese methods will not be repeated here.
[0155] Furthermore, as Figure 2 The specific implementation of the method shown in this embodiment provides a data transmission device that can be applied to the receiving end side, such as... Figure 4 As shown, the device includes:
[0156] The second receiving module 41 is used to receive encrypted data and encrypted ciphertext sent by the sending end, which are encrypted with the first target public key;
[0157] The second decryption module 42 is used to decrypt the encrypted data and the encrypted ciphertext using the first target private key corresponding to the first target public key, so as to obtain the encrypted data and the encrypted ciphertext.
[0158] The third decryption module 43 is used to decrypt the encrypted ciphertext based on the elliptic curve encryption algorithm to obtain the first decryption key;
[0159] The fourth decryption module 44 is used to decrypt the encrypted data using the first decryption key to obtain the target request data.
[0160] In specific application scenarios, such as Figure 4 As shown, the device also includes: an acquisition module 45, a fourth encryption module 46, and a sending module 47;
[0161] The acquisition module 45 is used to acquire a data transmission request, which includes user authentication information, receiving end IP address and data identifier;
[0162] The fourth encryption module 46 is used to encrypt the data transmission request using the second target public key of the sending end to obtain the encrypted data transmission request;
[0163] The sending module 47 is used to send the encrypted data transmission request to the sending end, so that the sending end can use the second target private key corresponding to the second target public key to decrypt the encrypted data transmission request and obtain the decrypted data transmission request.
[0164] It should be noted that other corresponding descriptions of the functional units involved in the data transmission device applicable to the receiving end side provided in this embodiment can be found in the following references. Figure 1 The corresponding descriptions of the Chinese methods will not be repeated here.
[0165] Based on the above, Figure 1 and Figure 2 Accordingly, this disclosure also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method. Figure 1 and Figure 2 The method shown.
[0166] Based on this understanding, the technical solution of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, or portable hard drive) and includes several instructions to cause a computer device (such as a personal computer, server, or network device) to execute the methods of various implementation scenarios of this disclosure.
[0167] Based on the above, Figure 1 and Figure 2 The method shown, and Figure 3 , Figure 4 To achieve the above objectives, this disclosure also provides an electronic device, configurable on a vehicle (e.g., an electric vehicle), in accordance with the illustrated virtual device embodiment. The device includes a storage medium and a processor; the storage medium stores a computer program; the processor executes the computer program to implement the above-described virtual device. Figure 1 and Figure 2 The method shown.
[0168] Optionally, the aforementioned physical devices may also include a user interface, a network interface, a camera, radio frequency (RF) circuitry, sensors, audio circuitry, a Wi-Fi module, etc. The user interface may include a display screen, input units such as a keyboard, etc., and optional user interfaces may also include USB interfaces, card reader interfaces, etc. The network interface may optionally include standard wired interfaces, wireless interfaces (such as Wi-Fi interfaces), etc.
[0169] Those skilled in the art will understand that the physical device structure provided in this disclosure does not constitute a limitation on the physical device, and may include more or fewer components, or a combination of certain components, or different component arrangements.
[0170] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the aforementioned physical device, supporting the operation of information processing programs and other software and / or programs. The network communication module is used to enable communication between the various components within the storage medium, as well as communication with other hardware and software in the information processing physical device.
[0171] Through the above description of the embodiments, those skilled in the art can clearly understand that this disclosure can be implemented by means of software plus necessary general-purpose hardware platforms, or it can be implemented by hardware. Compared with the prior art, the data transmission method, apparatus, and electronic device provided by this disclosure generate random numbers, generate a first encryption key based on the random numbers; encrypt the target request data using the first encryption key to obtain encrypted data; determine a second encryption key based on an elliptic curve, encrypt the first encryption key using the second encryption key to obtain encrypted ciphertext; encrypt the encrypted data and encrypted ciphertext using the first target public key of the receiving end, and transmit the encrypted data and encrypted ciphertext to the receiving end, so that the receiving end can decrypt the encrypted data and encrypted ciphertext using the first target private key corresponding to the first target public key; decrypt the encrypted ciphertext to obtain a first decryption key; and decrypt the encrypted data using the first decryption key to obtain the target request data. By applying the technical solution of this disclosure, by introducing a dynamic key management mechanism, i.e., generating random numbers and generating a first encryption key based on the random numbers, it ensures that the encryption key used for each transmission is unique, thereby avoiding the security risks that may be caused by using a fixed key. By introducing a multi-layered encryption strategy, the first layer of encryption encrypts the target request data using a first encryption key, ensuring basic data security during transmission. The second layer uses an elliptic curve algorithm to determine a second encryption key, which is then used to encrypt the first encryption key, resulting in encrypted ciphertext, providing additional security protection for the first encryption key. The third layer uses the receiving end's first target public key to encrypt both the encrypted data and the encrypted ciphertext again, before transmitting the entire encrypted data to the receiving end. By leveraging the security of public-key encryption, even if the encrypted data and ciphertext are intercepted during transmission, they cannot be decrypted without the corresponding private key, significantly reducing data security risks.
[0172] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the term "comprising" or any other variations thereof is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.
[0173] The above are merely specific embodiments of this disclosure, enabling those skilled in the art to understand or implement this disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to these embodiments, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.
Claims
1. A data transmission method, characterized in that, The method, applied to the sending end, includes: The receiver receives a data transmission request sent by the receiving end, and the data transmission request is encrypted using the second target public key of the sending end; The encrypted data transmission request is decrypted using the second target private key corresponding to the second target public key to obtain the decrypted data transmission request, which includes user authentication information and the receiving end IP address. Verify the user authentication information; If the user authentication information is verified successfully, a first random number is generated. Generating a first encryption key based on the first random number includes: obtaining the number of nodes on the transmission path between the sending end and the receiving end; obtaining a perturbation code based on the product of the first random number and the number of nodes; performing hash operations on the perturbation code and the IP address of the receiving end to obtain a first hash value and a second hash value; and obtaining the first encryption key based on the sum of the first hash value and the second hash value. The target request data is encrypted using the first encryption key to obtain encrypted data; The second encryption key is determined based on the elliptic curve, and the first encryption key is encrypted using the second encryption key to obtain the encrypted ciphertext. The encrypted data and the encrypted ciphertext are encrypted using the first target public key of the receiving end, and the encrypted data and the encrypted ciphertext are transmitted to the receiving end. The receiving end then uses the first target private key corresponding to the first target public key to decrypt the encrypted data and the encrypted ciphertext to obtain the encrypted data and the encrypted ciphertext. The encrypted ciphertext is then decrypted to obtain a first decryption key. The encrypted data is then decrypted using the first decryption key to obtain the target request data.
2. The method according to claim 1, characterized in that, The method further includes: If the user authentication information fails to be verified, an authentication failure message is sent to the receiving end.
3. The method according to claim 2, characterized in that, The verification of the user authentication information includes: The user authentication information is verified using a blockchain, wherein the blockchain is used to store user authentication records; If the blockchain does not store a user authentication record that matches the user authentication information, the verification fails. If the blockchain stores a user authentication record that matches the user authentication information, then user access permissions are obtained, and access permissions for the target request data are obtained based on the user access permissions. Compare the user's access permissions with the access permissions granted; If the user's access permissions are greater than or equal to the access permissions granted, then the verification is successful. If the user's access permissions are less than the access permissions granted, then the verification is deemed unsuccessful.
4. The method according to claim 1, characterized in that, The data transmission request also includes a data identifier.
5. The method according to claim 1, characterized in that, The determination of the second encryption key based on elliptic curves includes: Determine any random point, a prime number, and a second random number of the elliptic curve; The second encryption key is determined based on the random point, the prime number, and the second random number.
6. The method according to claim 5, characterized in that, The step of encrypting the encrypted data and the encrypted ciphertext using the first target public key of the receiving end, and transmitting the encrypted data and the encrypted ciphertext to the receiving end, includes: The encrypted data, the encrypted ciphertext, the random point, the prime number, and the second random number are encrypted using the first target public key of the receiving end, and the encrypted data, the encrypted ciphertext, the random point, the prime number, and the second random number are transmitted to the receiving end.
7. A data transmission method, characterized in that, The method, applied to the receiving end side, includes: Receive encrypted data and encrypted ciphertext sent by the sender using the first target public key; The encrypted data and the encrypted ciphertext are decrypted using the first target private key corresponding to the first target public key to obtain the encrypted data and the encrypted ciphertext. The encrypted ciphertext is decrypted using an elliptic curve cryptography algorithm to obtain the first decryption key; The encrypted data is decrypted using the first decryption key to obtain the target request data; The sending end is used to execute the method according to any one of claims 1 to 6.
8. The method according to claim 7, characterized in that, Before the encrypted data and ciphertext encrypted with the first target public key are sent by the receiving and sending end, the method further includes: Obtain a data transmission request, which includes user authentication information, the receiving end IP address, and a data identifier; The data transmission request is encrypted using the second target public key of the sending end to obtain the encrypted data transmission request. The encrypted data transmission request is sent to the sending end, so that the sending end can decrypt the encrypted data transmission request using the second target private key corresponding to the second target public key, and obtain the decrypted data transmission request.
9. A data transmission device, characterized in that, Applied to the transmitting end side, the device includes: The first receiving module is used to receive a data transmission request sent by the receiving end, wherein the data transmission request is encrypted using the second target public key of the sending end; The first decryption module is used to decrypt the encrypted data transmission request using the second target private key corresponding to the second target public key, so as to obtain the decrypted data transmission request, which includes user authentication information and the receiving end IP address. The verification module is used to verify the user authentication information; The generation module is configured to generate a first random number if the user authentication information is verified successfully, and to generate a first encryption key based on the first random number, including: obtaining the number of nodes on the transmission path between the sending end and the receiving end; obtaining a perturbation code based on the product of the first random number and the number of nodes; performing hash operations on the perturbation code and the IP address of the receiving end respectively to obtain a first hash value and a second hash value; and obtaining the first encryption key based on the sum of the first hash value and the second hash value. The first encryption module is used to encrypt the target request data using the first encryption key to obtain encrypted data; The second encryption module is used to determine the second encryption key based on the elliptic curve, and to encrypt the first encryption key using the second encryption key to obtain encrypted ciphertext. The third encryption module is used to encrypt the encrypted data and the encrypted ciphertext using the first target public key of the receiving end, and transmit the encrypted data and the encrypted ciphertext to the receiving end, so that the receiving end can decrypt the encrypted data and the encrypted ciphertext using the first target private key corresponding to the first target public key to obtain the encrypted data and the encrypted ciphertext; decrypt the encrypted ciphertext to obtain a first decryption key; and use the first decryption key to decrypt the encrypted data to obtain the target request data.
10. A data transmission device, characterized in that, Applied to the receiving end side, the device includes: The second receiving module is used to receive encrypted data and encrypted ciphertext sent by the sending end, which are encrypted with the first target public key; The second decryption module is used to decrypt the encrypted data and the encrypted ciphertext using the first target private key corresponding to the first target public key, so as to obtain the encrypted data and the encrypted ciphertext. The third decryption module is used to decrypt the encrypted ciphertext based on the elliptic curve encryption algorithm to obtain the first decryption key; The fourth decryption module is used to decrypt the encrypted data using the first decryption key to obtain the target request data; The sending end is used to execute the method according to any one of claims 1 to 6.
11. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 6, or the method of any one of claims 7 to 8.
12. A computer-readable storage medium, wherein instructions in the computer-readable storage medium, when executed by a processor of an electronic device, enable the electronic device to perform the method as claimed in any one of claims 1 to 6, or the method as claimed in any one of claims 7 to 8.
13. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 6, or the method according to any one of claims 7 to 8.
Citation Information
Patent Citations
Data transmission processing method and system, computer equipment and storage medium
CN117176351A
Message data transmission method and device, electronic equipment and storage medium
CN117640091A