Data encryption transmission method and system

Abstract

The present invention relates to the field of information security technology, specifically to a data encryption transmission method and system, including: dividing plaintext data into multiple encryption layers at the sending end, each layer is encrypted using a different symmetric key, the sending end and the receiving end generate their own asymmetric key pairs, the sending end uses the public key of the receiving end to encrypt the last layer of keys, and transmits the encrypted keys together with the multi-layer encrypted data; the multi-layer encrypted data is divided into data blocks of the same size, randomly arranged and added with unique identifiers, and redundant data blocks are generated at the same time; the data block transmission path is changed irregularly through a multi-path transmission mechanism and a path random algorithm; the receiving end splices the data blocks, verifies the integrity and correctness, uses the private key to decrypt the last layer of keys, and decrypts the data layer by layer. The present invention combines a variety of encryption technologies and security mechanisms, and provides a flexible and efficient data encryption transmission solution that can adapt to different application scenarios and security requirements.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a data encryption transmission method and system. Background Art

[0002] In modern society, data security and privacy protection have become increasingly important issues. With the rapid development of the Internet and communication technologies, a large amount of sensitive information is transmitted over the network. How to ensure the confidentiality, integrity and availability of data during transmission has become a key challenge.

[0003] Traditional data encryption methods, such as symmetric encryption and asymmetric encryption, provide data protection to a certain extent. However, these methods still have some limitations. Symmetric encryption algorithms have key management issues. Once the key is leaked, all data encrypted with the key will be threatened. Asymmetric encryption algorithms have a large computational overhead and are not suitable for encrypting large amounts of data.

[0004] In addition, a single encryption method may not provide sufficient security during data transmission. When data is transmitted in the network, it faces various potential attacks and threats, such as man-in-the-middle attacks, data tampering, replay attacks, etc. Attackers may intercept data packets, analyze and crack them, and obtain sensitive information.

[0005] To address these challenges, multi-layer encryption technology is considered a promising solution. By dividing data into multiple layers, each layer using a different encryption algorithm and key, the security of data can be significantly improved. Even if one layer is cracked, the protection of other layers is still effective.

[0006] However, traditional multi-layer encryption schemes still have some problems in practical applications. For example, key management is complex, and each layer needs to generate and distribute independent keys; the order and integrity of data during transmission are difficult to guarantee; and the data transmission path is single and vulnerable to attacks and eavesdropping.

[0007] Therefore, there is an urgent need for a more secure, efficient and flexible data encryption transmission solution that can comprehensively use multiple encryption technologies and combine dynamic key management, data segmentation, redundant coding, multi-path transmission and other mechanisms to comprehensively improve the confidentiality, integrity and reliability of data during transmission. This will provide stronger protection for data security in various fields and help build a more secure and trustworthy network environment. Summary of the invention

[0008] To achieve the above-mentioned purpose, the present invention provides a data encryption transmission method and system, and the specific technical scheme is as follows: A data encryption transmission method, comprising:

[0009] By adopting multi-layer encryption technology, the plaintext data is divided into multiple encryption layers at the sending end. Each encryption layer is encrypted using a different key of the symmetric encryption algorithm, and an independent dynamic key is set for each encryption layer.

[0010] The sender and receiver generate their own asymmetric key pairs respectively. The sender uses the receiver's public key to encrypt the key of the last layer of encryption and transmits the encrypted key together with the multi-layer encrypted data.

[0011] The multi-layer encrypted data is divided into data blocks of the same size. Each data block is randomly arranged before transmission, and a unique identifier is added to each data block. At the same time, the data blocks are encoded to generate redundant data blocks.

[0012] Build a multi-path transmission mechanism and use a path randomization algorithm to change the transmission path of data blocks from time to time;

[0013] After receiving the encrypted data, the receiving end splices the data blocks based on the unique identifier of the data blocks, and performs integrity and correctness verification. The receiving end uses its own private key to decrypt the key of the last layer, and then decrypts each encryption layer one by one in the decryption order.

[0014] Preferably, by adopting a multi-layer encryption technology, the plaintext data D is divided into u encryption layers at the sending end, and each encryption layer is encrypted using a different key of a symmetric encryption algorithm, and the symmetric encryption algorithm adopts AES-256 as a symmetric encryption algorithm; for each encryption layer of the plaintext data, a different key is used for encryption;

[0015] According to the number of encryption layers divided by the plaintext data, the plaintext data is encrypted in the first layer using key K1 to obtain ciphertext C1=AES-256(K1, D); the ciphertext C1 is encrypted in the second layer using key K2 to obtain ciphertext C2=AES-256(K2, C1); and so on, until the last layer of encryption is completed, the final ciphertext Cu=AES-256(Ku, Cu-1) is obtained; where u is the number of encryption layers divided by the plaintext data;

[0016] In the AES-256 encryption algorithm, a pseudo-random number generator is used to generate a random key. According to the required key length, a random byte sequence of the corresponding length is generated as a dynamic key. When encrypting plaintext data, dynamic keys K1 to Ku are generated. After the encryption of the first encryption layer is completed, the key K1 is stored in the second encryption layer, and so on, the key of the u-1th encryption layer is stored in the uth layer.

[0017] Preferably, respective asymmetric key pairs are generated at the sending end and the receiving end respectively. The sending end generates an RSA key pair including a public key PubKey_S and a private key PrivKey_S; the receiving end generates an RSA key pair including a public key PubKey_R and a private key PrivKey_R;

[0018] When performing layered encryption on plaintext data, the sender uses the public key PubKey_R1 of the receiver's RSA key to encrypt the key Ku of the uth encryption layer of the AES-256 encryption algorithm;

[0019] The sender packages the encrypted key EKu with multiple layers of encrypted data Cu.

[0020] Preferably, dividing the multi-layer encrypted data into data blocks of the same size comprises:

[0021] The multi-layer encrypted data Cu is divided according to a predetermined block size to obtain a plurality of divided data blocks (B1, B2, ..., Bt); m redundant data blocks of the same data format and size are randomly inserted into the plurality of divided data blocks (B1, B2, ..., Bt) to form (B1, B2, ..., Bt, R1, R2, ..., Rm) data blocks;

[0022] Generate a random globally unique identifier GUID for each data block, and use the UUID algorithm to generate a 128-bit globally unique identifier GUID;

[0023] Append the generated unique identifier to the corresponding data block to form a new data block format [GUID, B];

[0024] Use a random number generator to generate a random sorting sequence and randomly arrange all the data blocks after segmentation;

[0025] According to the order of the divided data blocks (B1, B2, ... Bt), the sorting sequence of the GUIDs of the data blocks (B1, B2, ... Bt) before the redundant data blocks are inserted is recorded;

[0026] The sorted sequence of GUIDs of data blocks (B1, B2, ...Bt) is encrypted. The sender uses the public key PubKey_R2 of the receiver's RSA key to encrypt the sorted sequence of random global unique identifiers GUIDs, and transmits the encrypted sorted sequence of GUIDs to the receiver separately.

[0027] Preferably, a weighted random algorithm is constructed to select one of the multiple transmission paths as the encrypted data transmission path;

[0028] Obtain relevant indicators of candidate transmission paths, and obtain the performance indicators of bandwidth, delay, and packet loss rate of each candidate transmission path through the network monitoring mechanism; collect factors that affect path selection, including path reliability, security assessment results, and energy consumption; construct a comprehensive score calculation formula to calculate the comprehensive score of each path:

[0029]

[0030] Among them, score represents the comprehensive score of each candidate path, bw represents the bandwidth of the path, rel represents the reliability evaluation value of the path, lat represents the delay of the path, loss represents the packet loss rate of the path, Sec represents the security evaluation value of the path, and ec represents the energy consumption of the path; α, β, γ, δ, ε are adjustable parameters used to control the relative importance of each indicator in the comprehensive score;

[0031] According to the constructed comprehensive score calculation formula, the comprehensive score of each candidate path is calculated.

[0032] Preferably, the selection probability of the path is calculated, and the comprehensive scores of all candidate paths are indexed to obtain an indexed score: The score i represents the comprehensive score of the i-th candidate path, es i represents the indexed score of the i-th candidate path;

[0033] Calculate the sum of the indexed scores: Where k represents the number of candidate paths;

[0034] Calculate the selection probability of each path: Perform weighted random selection; generate a random number rand between 0 and 1 to determine the selected path, where prob i represents the selection probability of the i-th candidate path;

[0035] According to the selection probability of the candidate path, the interval from 0 to 1 is divided into multiple sub-intervals, each sub-interval corresponds to a candidate path; the sub-interval division method is:

[0036] [0, prob1), [prob1, prob1+prob2),..., [prob1+...+prob k-1 , 1]

[0037] Wherein, k represents the number of candidate paths; it is determined in which subinterval the random number rand falls, and the corresponding candidate path is selected as the current encrypted data transmission path.

[0038] Preferably, the receiving end receives the encrypted data block (B′1, B′2, ..., B′t, ..., R′1, R′2, ..., R′m) through the constructed multi-path transmission mechanism; at the same time, the receiving end receives the encrypted GUID sorting sequence transmitted by the sending end; the receiving end uses its own RSA private key PrivKey_R2 to decrypt the encrypted GUID sorting sequence to obtain the GUID sorting sequence of the original data block;

[0039] According to the decrypted GUID sorting sequence, the received encrypted data blocks (B′1, B′2, ..., B′t, ..., R′1, R′2, ..., R′m) are reordered to restore the order before the redundant data blocks are inserted (B1, B2, ...Bt, R1, R2, ..., Rm);

[0040] Remove the inserted redundant data blocks (R1, R2, ..., Rm) to obtain the original encrypted data blocks (B1, B2, ..., Bt);

[0041] According to the original GUID sorting sequence, the encrypted data blocks (B1, B2, ..., Bt) are concatenated to restore the complete multi-layer encrypted data Cu;

[0042] Perform hash operation on the concatenated multi-layer encrypted data Cu to obtain a hash value H(Cu), and compare the calculated hash value H(Cu) with the original hash value transmitted by the sender;

[0043] If the two hash values ​​are the same, the data has not been tampered with during transmission and the integrity is verified;

[0044] If the two hash values ​​are different, the data has been tampered with during transmission, the integrity check fails, and the sender needs to be requested to retransmit the data;

[0045] The receiver uses its own RSA private key PrivKey_R1 to decrypt the encrypted last layer key EKu:

[0046] Calculate the decrypted key Ku = EKu^d′mod n′, where d′ is the private exponent of the RSA private key of the receiving end, and obtain the decrypted final key Ku;

[0047] Decrypt each encryption layer layer by layer in the decryption order: starting from the last encryption layer, use the decrypted key Ku to decrypt the data Cu encrypted in the uth layer:

[0048] Cu-1=AES-256_Decrypt(Ku,Cu);

[0049] Continue to decrypt the data Cu-1 encrypted at the u-1th layer, using the key Ku-1 at the u-1th layer:

[0050] Cu-2=AES-256_Decrypt(Ku-1, Cu-1);

[0051] And so on, until the first layer of encrypted data C1 is decrypted:

[0052] D=AES-256_Decrypt(K1,C1);

[0053] The decryption is completed and the original plaintext data D is obtained.

[0054] A data encryption transmission system, which is used to implement the data encryption transmission method, comprises: an encryption layer module, a key module, a data block module, a transmission path module and a decryption module;

[0055] The encryption layer module divides the plaintext data into multiple encryption layers at the sending end by adopting multi-layer encryption technology, each encryption layer is encrypted using a different key of a symmetric encryption algorithm, and an independent dynamic key is set for each encryption layer;

[0056] The key module is used to generate respective asymmetric key pairs at the sending end and the receiving end respectively, and the sending end uses the public key of the receiving end to encrypt the key of the last layer of encryption, and transmits the encrypted key together with the multi-layer encrypted data;

[0057] The data block module is used to divide the multi-layer encrypted data into data blocks of the same size, randomly arrange each data block before transmission, and add a unique identifier to each data block; at the same time, encode the data blocks to generate redundant data blocks;

[0058] The transmission path module is used to construct a multi-path transmission mechanism and use a path randomization algorithm to irregularly change the transmission path of the data block;

[0059] The decryption module is used to splice the data blocks based on the unique identifiers of the data blocks after the receiving end receives the encrypted data, and to check the integrity and correctness. The receiving end uses its own private key to decrypt the key of the last layer, and then decrypts each encryption layer layer by layer in the decryption order.

[0060] An electronic device comprises: a processor and a memory, wherein the memory stores a computer program that can be called by the processor; the processor executes the data encryption transmission method by calling the computer program stored in the memory.

[0061] A computer-readable storage medium stores instructions, and when the instructions are run on a computer, the computer executes the data encryption transmission method.

[0062] Beneficial effects of the present invention: The present invention can improve data security by adopting multi-layer encryption technology to divide plaintext data into multiple encryption layers. Each encryption layer is encrypted using a different symmetric encryption algorithm and key. Even if one layer is cracked, the protection of other layers is still effective, which greatly improves data security.

[0063] The present invention sets an independent dynamic key for each encryption layer, avoiding the problem of complex key management in traditional solutions. At the same time, the sending end uses the public key of the receiving end to encrypt the key of the last layer, ensuring the security of key transmission.

[0064] The present invention divides the multi-layer encrypted data into data blocks of the same size, adds a unique identifier to each data block, and randomly arranges them during transmission, so that the order and integrity of the data are guaranteed. The receiving end can splice and verify the data blocks according to the unique identifier.

[0065] The present invention encodes data blocks to generate redundant data blocks. Even if part of the data blocks are lost or damaged during the transmission process, the original data can still be restored through the redundant data blocks, thereby improving the reliability of data transmission.

[0066] The present invention constructs a multi-path transmission mechanism, uses a path randomization algorithm, and irregularly changes the transmission path of a data block, making it difficult for an attacker to lock and intercept data, thereby improving the security of data transmission.

[0067] The present invention combines a variety of encryption technologies and security mechanisms to provide a flexible and efficient data encryption transmission solution that can adapt to different application scenarios and security requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 A flow chart of a data encryption transmission method provided by the present invention;

[0069] Figure 2 A structural diagram of a data encryption transmission system provided by the present invention;

[0070] Figure 3 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention;

[0071] Figure 4 It is a schematic diagram of the structure of a computer-readable storage medium provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0072] In order to better understand the present invention, a more detailed description will be made of various aspects of the present invention with reference to the accompanying drawings. It should be understood that these detailed descriptions are only descriptions of exemplary embodiments of the present invention, and are not intended to limit the scope of the present invention in any way. Throughout the specification, the same reference numerals refer to the same elements. The expression "and / or" includes any and all combinations of one or more of the associated listed items.

[0073] In the accompanying drawings, the size, dimensions and shapes of the elements have been slightly adjusted for ease of illustration. The accompanying drawings are for illustration only and are not strictly drawn to scale. As used herein, the terms "substantially", "approximately" and similar terms are used as terms of approximation, not as terms of degree, and are intended to illustrate the inherent deviations in measurements or calculations that will be recognized by those of ordinary skill in the art. In addition, in the present invention, the order in which the steps are described does not necessarily represent the order in which these processes occur in actual operation, unless otherwise specified or can be derived from the context.

[0074] It should also be understood that expressions such as "comprises", "including", "having", "includes" and / or "comprising" are open rather than closed expressions in this specification, which indicate the presence of the stated features, elements and / or components, but do not exclude the presence of one or more other features, elements, components and / or combinations thereof. In addition, when expressions such as "at least one of..." appear after a list of listed features, they modify the entire list of features rather than just the individual elements in the list. In addition, when describing embodiments of the present invention, "may" is used to mean "one or more embodiments of the present invention". And, the term "exemplary" is intended to refer to an example or illustration.

[0075] Unless otherwise defined, all words (including engineering terms and scientific and technological terms) used in this article have the same meaning as those commonly understood by ordinary technicians in the field to which the present invention belongs. It should also be understood that unless there is a clear explanation in the present invention, the words defined in the commonly used dictionary should be interpreted as having the same meaning as their meaning in the context of the relevant technology, and should not be interpreted in an idealized or overly formal sense.

[0076] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments of the present invention can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0077] Example 1

[0078] Reference Figure 1 , which is the first embodiment of the present invention, provides a data encryption transmission method.

[0079] S1: By adopting multi-layer encryption technology, the plaintext data is divided into multiple encryption layers at the sending end. Each encryption layer is encrypted using a different key of the symmetric encryption algorithm, and an independent dynamic key is set for each encryption layer.

[0080] By adopting multi-layer encryption technology, the plaintext data D is divided into u encryption layers at the sending end, and each encryption layer is encrypted using a different key of a symmetric encryption algorithm. The symmetric encryption algorithm adopts AES-256 as the symmetric encryption algorithm; for each encryption layer of the plaintext data, a different key is used for encryption.

[0081] According to the number of encryption layers divided by the plaintext data, the plaintext data is encrypted in the first layer using key K1 to obtain ciphertext C1=AES-256(K1,D); the ciphertext C1 is encrypted in the second layer using key K2 to obtain ciphertext C2=AES-256(K2,C1); and so on, until the last layer of encryption is completed, the final ciphertext Cu=AES-256(Ku,Cu-1) is obtained; where u is the number of encryption layers divided by the plaintext data.

[0082] S2: The sender and receiver generate their own asymmetric key pairs respectively. The sender uses the public key of the receiver to encrypt the key of the last layer of encryption and transmits the encrypted key together with the multi-layer encrypted data.

[0083] In the AES-256 encryption algorithm, a pseudo-random number generator is used to generate a random key. According to the required key length, a 256-bit key is required in the AES-256 encryption algorithm, and a random byte sequence of the corresponding length is generated as a dynamic key. When encrypting plaintext data, dynamic keys K1 to Ku are generated. At the same time, after the encryption of the first encryption layer is completed, the key K1 is stored in the second encryption layer, and so on, the key of the u-1th encryption layer is stored in the uth layer.

[0084] The sending end and the receiving end generate their own asymmetric key pairs respectively. The sending end generates an RSA key pair, including a public key PubKey_S and a private key PrivKey_S; the receiving end generates an RSA key pair, including a public key PubKey_R and a private key PrivKey_R.

[0085] When performing layered encryption on plaintext data, the sender uses the public key PubKey_R1 of the receiver's RSA key to encrypt the key Ku of the uth encryption layer of the AES-256 encryption algorithm;

[0086] Generation of asymmetric key pairs:

[0087] The sender generates an RSA key pair:

[0088] Select two large prime numbers p and q, and calculate n = p*q;

[0089] Calculate the Euler function φ(n)=(p-1)*(q-1);

[0090] Select an integer e such that 1<e<φ(n) and gcd(e, φ(n))=1;

[0091] Calculate d so that d*e≡1(modφ(n)); where the mod(·) function is the result of the modular operation, and the gcd(·) function is used to calculate the greatest common divisor of two numbers;

[0092] The public key is (n, e) and the private key is (n, d).

[0093] The receiving end generates an RSA key pair:

[0094] Select two large prime numbers p′ and q′, and calculate n′=p′*q′;

[0095] Calculate the Euler function φ(n′)=(p′-1)*(q′-1);

[0096] Select an integer e′ such that 1<e′<φ(n′) and gcd(e′, φ(n′))=1;

[0097] Calculate d′ so that d′*e′≡1(modφ(n′));

[0098] The public key is (n', e') and the private key is (n', d').

[0099] The final key encryption:

[0100] The sender uses the public key (n′, e′) of the receiver to encrypt the key Ku of the last layer:

[0101] Convert the key Kn into an integer m, satisfying 0≤m<n′;

[0102] Calculate the encrypted key c = m^e′modn′;

[0103] The encrypted key c is recorded as EKu.

[0104] Multi-layer encryption of data:

[0105] For the plaintext data D, encrypt it according to the multi-layer encryption scheme described above:

[0106] First layer encryption: C1 = AES-256 (K1, D);

[0107] Second layer encryption: C2 = AES-256 (K2, C1);

[0108] The u-th layer encryption: Cu=AES-256(Ku, Cu-1).

[0109] For example, when the number of encryption layers is 3, the Python language code for encrypting plaintext data and generating keys using the AES-256 encryption algorithm is:

[0110]

[0111]

[0112] The sender packages the encrypted key EKu with multiple layers of encrypted data Cu.

[0113] S3: Divide the multi-layer encrypted data into data blocks of the same size, randomly arrange each data block before transmission, and add a unique identifier to each data block; at the same time, encode the data blocks to generate redundant data blocks.

[0114] Divide the multi-layer encrypted data into data blocks of the same size. Based on network conditions and transmission efficiency, select the appropriate block size, including 1024 bytes or 4096 bytes.

[0115] The multi-layer encrypted data Cu is divided according to a predetermined block size to obtain a plurality of divided data blocks (B1, B2, ...Bt); m redundant data blocks of the same data format and size are randomly inserted into the plurality of divided data blocks (B1, B2, ...Bt), and the redundant data blocks may be garbled data blocks; (B1, B2, ...Bt, R1, R2, ..., Rm) data blocks are formed; the number m of redundant blocks can be adjusted according to network conditions and fault tolerance requirements, and can be 10% to 30% of the total number of data blocks.

[0116] A random globally unique identifier GUID is generated for each data block, and a 128-bit globally unique identifier GUID is generated using a UUID algorithm.

[0117] The generated unique identifier is appended to the corresponding data block to form a new data block format [GUID, B].

[0118] Exemplarily, a random number generator is used to generate a random sorting sequence, such as the Fisher-Yates shuffle algorithm, to randomly arrange all the data blocks after segmentation:

[0119] Initialize an array arr containing numbers 1 to m;

[0120] For each position of i from m-1 to 1:

[0121] Generate a random number j, satisfying 0≤j≤i;

[0122] Swap arr[i] and arr[j];

[0123] The resulting array arr is a random permutation sequence;

[0124] Reorder the data blocks according to the generated random permutation sequence;

[0125] The sorted data blocks are denoted as B′1, B′2, ..., B′t.

[0126] According to the order of the divided data blocks (B1, B2, ... Bt), the sorted sequence of the GUIDs of the data blocks (B1, B2, ... Bt) before the redundant data blocks are inserted is recorded.

[0127] The sorted sequence of GUIDs of data blocks (B1, B2, ...Bt) is encrypted. The sender uses the public key PubKey_R2 of the receiver's RSA key to encrypt the sorted sequence of random global unique identifiers GUIDs, and transmits the encrypted sorted sequence of GUIDs to the receiver separately.

[0128] S4: Build a multi-path transmission mechanism and use a path randomization algorithm to change the transmission path of data blocks from time to time.

[0129] A weighted random algorithm is constructed to select one of multiple transmission paths as the encrypted data transmission path.

[0130] Obtain relevant indicators of candidate transmission paths, and obtain the performance indicators of bandwidth, delay, and packet loss rate of each candidate transmission path through the network monitoring mechanism; collect factors that affect path selection, including path reliability, security assessment results, and energy consumption; construct a comprehensive score calculation formula to calculate the comprehensive score of each path:

[0131]

[0132] Among them, score represents the comprehensive score of each candidate path, bw represents the bandwidth of the path, rel represents the reliability evaluation value of the path, lat represents the delay of the path, loss represents the packet loss rate of the path, seC represents the security evaluation value of the path, and ec represents the energy consumption of the path; α, β, γ, δ, and ε are adjustable parameters used to control the relative importance of each indicator in the comprehensive score.

[0133] The larger the parameter value, the greater the impact of the corresponding indicator on the comprehensive score; the larger the values ​​of α, β, γ, δ, and ε, the greater the impact of the corresponding indicator on the comprehensive score; the impact of energy consumption on the comprehensive score is in the form of square root, reflecting the nonlinear relationship between energy consumption and other indicators.

[0134] The comprehensive score of a path takes into account the impact of the path's bandwidth, reliability, delay, packet loss rate, and energy consumption on the path quality.

[0135] According to the constructed comprehensive score calculation formula, the comprehensive score of each candidate path is calculated.

[0136] Calculate the selection probability of the path, and index the comprehensive scores of all candidate paths to obtain the indexed scores: The score i represents the comprehensive score of the f-th candidate path, Es i Represents the indexed score of the i-th candidate path.

[0137] Calculate the sum of the indexed scores: Where k represents the number of candidate paths.

[0138] Calculate the selection probability of each candidate path: Perform weighted random selection; generate a random number rand between 0 and 1 to determine the selected path, where prob i represents the selection probability of the i-th candidate path.

[0139] According to the probability of path selection, the interval from 0 to 1 is divided into multiple sub-intervals, each of which corresponds to a candidate path. The sub-interval division method is as follows:

[0140] [0, prob1), [prob1, prob1+prob2),..., [prob1+...+prob k-1 , 1]

[0141] Wherein, k represents the number of candidate paths; it is determined in which subinterval the random number rand falls, and the corresponding candidate path is selected as the current encrypted data transmission path.

[0142] Regularly update the comprehensive score and reselect the transmission path. According to the set time interval or trigger condition, regularly update the comprehensive score of the candidate path; re-perform weighted random selection to select a new encrypted data transmission path, and switch the subsequent encrypted data transmission to the newly selected path.

[0143] S5: After receiving the encrypted data, the receiving end splices the data blocks based on the unique identifier of the data blocks, and performs integrity and correctness verification. The receiving end uses its own private key to decrypt the key of the last layer, and then decrypts each encryption layer one by one in the decryption order.

[0144] The receiving end receives the encrypted data block (B′1, B′2, ..., B′t, ..., R′1, R′2, ..., R′m) through the constructed multi-path transmission mechanism; at the same time, the receiving end receives the encrypted GUID sorting sequence transmitted by the sending end; the receiving end uses its own RSA private key PrivKey_R2 to decrypt the encrypted GUID sorting sequence to obtain the GUID sorting sequence of the original data block.

[0145] According to the decrypted GUID sorting sequence, the received encrypted data blocks (B′1, B′2, ..., B′t, ..., R′1, R′2, ..., R′m) are reordered and restored to the order before inserting the redundant data blocks (B1, B2, ...Bt, R1, R2, ..., Rm).

[0146] The inserted redundant data blocks (R1, R2, ..., Rm) are removed to obtain the original encrypted data blocks (B1, B2, ..., Bt).

[0147] According to the original GUID sorting sequence, the encrypted data blocks (B1, B2, ..., Bt) are spliced ​​to restore the complete multi-layer encrypted data Cu.

[0148] Perform hash operation on the concatenated multi-layer encrypted data Cu to obtain a hash value H(Cu), and compare the calculated hash value H(Cu) with the original hash value transmitted by the sender;

[0149] If the two hash values ​​are the same, the data has not been tampered with during transmission and the integrity is verified;

[0150] If the two hash values ​​are different, the data has been tampered with during transmission, the integrity check fails, and the sender needs to be requested to retransmit the data.

[0151] The receiver uses its own RSA private key PrivKey_R1 to decrypt the encrypted last layer key EKu:

[0152] Calculate the decrypted key Ku = EKu^d′modn′, where d′ is the private exponent of the RSA private key at the receiving end, and obtain the decrypted last layer key Ku.

[0153] Decrypt each encryption layer layer by layer in the decryption order: starting from the last encryption layer, use the decrypted key Ku to decrypt the data Cu encrypted in the uth layer:

[0154] Cu-1=AES-256_Decrypt(Ku,Cu);

[0155] Continue to decrypt the data Cu-1 encrypted at the u-1th layer, using the key Ku-1 at the u-1th layer:

[0156] Cu-2=AES-256_Decrypt(Ku-1, Cu-1);

[0157] And so on, until the first layer of encrypted data C1 is decrypted:

[0158] D=AES-256_Decrypt(K1,C1);

[0159] The decryption is completed and the original plaintext data D is obtained.

[0160] Example 2

[0161] Reference Figure 2 ,A second embodiment of the present invention provides a data encryption transmission system.

[0162] The system comprises: an encryption layer module, a key module, a data block module, a transmission path module and a decryption module.

[0163] The encryption layer module divides the plaintext data into multiple encryption layers at the sending end by adopting multi-layer encryption technology, each encryption layer is encrypted using a different key of a symmetric encryption algorithm, and an independent dynamic key is set for each encryption layer.

[0164] The key module is used to generate respective asymmetric key pairs at the sending end and the receiving end respectively. The sending end uses the public key of the receiving end to encrypt the key of the last layer of encryption, and transmits the encrypted key together with the multi-layer encrypted data.

[0165] The data block module is used to divide the multi-layer encrypted data into data blocks of the same size, randomly arrange each data block before transmission, and add a unique identifier to each data block; at the same time, encode the data blocks to generate redundant data blocks.

[0166] The transmission path module is used to construct a multi-path transmission mechanism and use a path randomization algorithm to irregularly change the transmission path of the data block.

[0167] The decryption module is used to splice the data blocks based on the unique identifiers of the data blocks after the receiving end receives the encrypted data, and to check the integrity and correctness. The receiving end uses its own private key to decrypt the key of the last layer, and then decrypts each encryption layer layer by layer in the decryption order.

[0168] Example 3

[0169] Figure 3 FIG. 1 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 3As shown, according to another aspect of the present invention, an electronic device 500 is also provided. The electronic device 500 may include one or more processors and one or more memories. The memories store computer readable codes, and when the computer readable codes are run by one or more processors, a data encryption transmission method as described above may be executed.

[0170] The method or system according to the embodiment of the present invention can also be used by Figure 3 The architecture of the electronic device shown is implemented.

[0171] like Figure 3 As shown, the electronic device 500 may include a bus 501, one or more CPUs 502, a read-only memory (ROM) 503, a random access memory (RAM) 504, a communication port 505 connected to a network, an input / output component 506, a hard disk 507, and the like.

[0172] The storage device in the electronic device 500, such as the ROM 503 or the hard disk 507, can store a data encryption transmission method provided by the present invention.

[0173] A data encryption transmission method comprises: by adopting a multi-layer encryption technology, plaintext data is divided into multiple encryption layers at the sending end, each encryption layer is encrypted using a different key of a symmetric encryption algorithm, and an independent dynamic key is set for each encryption layer; respective asymmetric key pairs are generated at the sending end and the receiving end, the sending end encrypts the key of the last layer of encryption using the public key of the receiving end, and the encrypted key is transmitted together with the multi-layer encrypted data; the multi-layer encrypted data is divided into data blocks of the same size, each data block is randomly arranged before transmission, and a unique identifier is added to each data block; the data blocks are encoded at the same time to generate redundant data blocks; a multi-path transmission mechanism is constructed, and a path random algorithm is used to change the transmission path of the data blocks at irregular intervals; after receiving the encrypted data at the receiving end, the data blocks are spliced ​​based on the unique identifiers of the data blocks, and integrity and correctness checks are performed, the receiving end uses its own private key to decrypt the key of the last layer, and then decrypts each encryption layer layer by layer according to the decryption order.

[0174] Furthermore, the electronic device 500 may also include a user interface 508. Figure 3 The architecture shown is only exemplary and can be omitted according to actual needs when implementing different devices. Figure 3 One or more components of an electronic device are shown.

[0175] Example 4

[0176] Figure 4 It is a schematic diagram of the structure of a computer-readable storage medium provided by an embodiment of the present invention.

[0177] like Figure 4 As shown, a computer readable storage medium 600 according to one embodiment of the present invention.

[0178] Computer readable storage medium 600 has computer readable instructions stored thereon.

[0179] When the computer-readable instructions are executed by a processor, a data encryption transmission method according to an embodiment of the present invention described with reference to the above drawings can be executed.

[0180] The storage medium 600 includes, but is not limited to, for example, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and cache memory (cache), etc. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. In addition, according to an embodiment of the present invention, the process described above with reference to the flowchart may be implemented as a computer software program.

[0181] For example, the present invention provides a non-temporary machine-readable storage medium, which stores machine-readable instructions, and the machine-readable instructions can be run by a processor to execute instructions corresponding to the method steps provided by the present invention, for example: by adopting a multi-layer encryption technology, the plaintext data is divided into multiple encryption layers at the sending end, each encryption layer is encrypted using a different key of a symmetric encryption algorithm, and an independent dynamic key is set for each encryption layer; respective asymmetric key pairs are generated at the sending end and the receiving end respectively, the sending end uses the public key of the receiving end to encrypt the key of the last layer of encryption, and the encrypted key is transmitted together with the multi-layer encrypted data; the multi-layer encrypted data is divided into data blocks of the same size, each data block is randomly arranged before transmission, and a unique identifier is added to each data block; the data blocks are encoded at the same time to generate redundant data blocks; a multi-path transmission mechanism is constructed, and a path random algorithm is used to change the transmission path of the data blocks from time to time; after the receiving end receives the encrypted data, the data blocks are spliced ​​based on the unique identifier of the data blocks, and integrity and correctness verification is performed, the receiving end uses its own private key to decrypt the key of the last layer, and then decrypts each encryption layer layer by layer in the decryption order.

[0182] When the computer program is executed by the central processing unit (CPU), the above functions defined in the method of the present invention are performed. The method, apparatus, and device of the present invention may be implemented in many ways. For example, the method, apparatus, and device of the present invention may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware.

[0183] The above sequence for the steps of the method is for illustration only, and the steps of the method of the present invention are not limited to the sequence specifically described above unless otherwise specifically stated.

[0184] In addition, in some embodiments, the present invention can also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present invention. Therefore, the present invention also covers a recording medium storing a program for executing the method according to the present invention.

[0185] In addition, the parts of the above technical solutions provided in the embodiments of the present invention that are consistent with the implementation principles of the corresponding technical solutions in the prior art are not described in detail to avoid excessive redundancy.

[0186] The specific implementation modes as described above further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation mode of the present invention and is not intended to limit the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data encryption transmission method, characterized in that: include: By adopting multi-layer encryption technology, the plaintext data is divided into multiple encryption layers at the sending end, each encryption layer is encrypted using a different key of the symmetric encryption algorithm, and an independent dynamic key is set for each encryption layer; The sending end and the receiving end generate their own asymmetric key pairs respectively. The sending end uses the public key of the receiving end to encrypt the key of the last layer of encryption, and transmits the encrypted key together with the multi-layer encrypted data; Divide the multi-layer encrypted data into data blocks of the same size, randomly arrange each data block before transmission, and add a unique identifier to each data block; at the same time, encode the data blocks to generate redundant data blocks; Construct a multi-path transmission mechanism and use a path randomization algorithm to randomly change the transmission path of data blocks; After receiving the encrypted data, the receiving end splices the data blocks based on the unique identifier of the data blocks, and performs integrity and correctness verification. The receiving end uses its own private key to decrypt the key of the last layer, and then decrypts each encryption layer layer by layer in the decryption order; By adopting multi-layer encryption technology, the plaintext data D is divided into u encryption layers at the sending end, and each encryption layer is encrypted using a different key of a symmetric encryption algorithm, and the symmetric encryption algorithm adopts AES-256 as a symmetric encryption algorithm; for each encryption layer of the plaintext data, a different key is used for encryption; According to the number of encryption layers divided by the plaintext data, the plaintext data is encrypted with key K1 in the first layer to obtain ciphertext C1 = AES-256 (K1, D); the ciphertext C1 is encrypted with key K2 in the second layer to obtain ciphertext C2 = AES-256 (K2, C1); and so on, until the last layer of encryption is completed, the final ciphertext Cu = AES-256 (Ku, Cu-1) is obtained; Where u is the number of encryption layers divided by the plaintext data; In the AES-256 encryption algorithm, a pseudo-random number generator is used to generate a random key. According to the required key length, a random byte sequence of the corresponding length is generated as a dynamic key. When encrypting plaintext data, dynamic keys K1 to Ku are generated. At the same time, after the encryption of the first encryption layer is completed, the key K1 is stored in the second encryption layer, and so on, the key of the u-1th encryption layer is stored in the uth layer. Generate asymmetric key pairs at the sender and receiver respectively. The sender generates an RSA key pair, including the public key PubKey_S and the private key PrivKey_S. The receiving end generates an RSA key pair, including the public key PubKey_R and the private key PrivKey_R; When performing layered encryption on plaintext data, the sender uses the public key PubKey_R1 of the receiver's RSA key to encrypt the key Ku of the uth encryption layer of the AES-256 encryption algorithm; The sender packages the encrypted key EKu with the multi-layer encrypted data Cu; Splitting multi-layer encrypted data into data blocks of equal size includes: The multi-layer encrypted data Cu is divided according to a predetermined block size to obtain a plurality of divided data blocks (B1, B2, ... Bt); m redundant data blocks of the same data format and size are randomly inserted into the plurality of divided data blocks (B1, B2, ... Bt) to form (B1, B2, ... Bt, R1, R2, ..., Rm) data blocks; Generate a random globally unique identifier GUID for each data block, and use the UUID algorithm to generate a 128-bit globally unique identifier GUID; The generated unique identifier is attached to the corresponding data block to form a new data block format [GUID, B], where B is the data block corresponding to the globally unique identifier GUID; Use a random number generator to generate a random sorting sequence and randomly arrange all the data blocks after segmentation; According to the order of the data blocks (B1, B2, ... Bt) after the division, record the sorting sequence of the GUIDs of the data blocks (B1, B2, ... Bt) before the redundant data blocks are inserted; The sorted sequence of GUIDs of data blocks (B1, B2, ... Bt) is encrypted. The sender uses the public key PubKey_R2 of the receiver's RSA key to encrypt the sorted sequence of random global unique identifiers GUIDs, and transmits the encrypted sorted sequence of GUIDs to the receiver separately.

2. A data encryption transmission method according to claim 1, characterized in that: Construct a weighted random algorithm to select one of multiple transmission paths as the encrypted data transmission path; Obtain relevant indicators of candidate transmission paths, and obtain the performance indicators of bandwidth, delay and packet loss rate of each candidate transmission path through the network monitoring mechanism; collect factors that affect path selection, including path reliability, security assessment results and energy consumption; construct a comprehensive score calculation formula to calculate the comprehensive score of each path: ； in, represents the comprehensive score of each candidate path, represents the bandwidth of the path, represents the reliability evaluation value of the path, represents the path delay, represents the packet loss rate of the path, represents the safety evaluation value of the path, represents the energy consumption of the path; , , , , It is an adjustable parameter used to control the importance of each indicator in the comprehensive score; According to the constructed comprehensive score calculation formula, the comprehensive score of each candidate path is calculated.

3. A data encryption transmission method according to claim 2, characterized in that: Calculate the probability of path selection and index the comprehensive scores of all candidate paths to obtain the indexed scores: ,in Indicates The comprehensive score of the candidate paths, Indicates Indexed scores of candidate paths; Calculate the sum of the indexed scores: ,in Indicates the number of candidate paths; Calculate the selection probability of each candidate path: Perform a weighted random selection; generate a random number between 0 and 1 , used to determine the selected path, where Indicates The selection probability of the candidate paths; According to the selection probability of the candidate path, the interval from 0 to 1 is divided into multiple sub-intervals, each sub-interval corresponds to a candidate path; the sub-interval division method is: ； Among them, k represents the number of candidate paths; the random number In which sub-interval does it fall, select the corresponding candidate path as the current encrypted data transmission path.

4. A data encryption transmission method according to claim 3, characterized in that: The receiving end receives the encrypted data block (B'1, B'2, ..., B't, ..., R'1, R'2, ..., R'm) through the constructed multi-path transmission mechanism; at the same time, the receiving end receives the encrypted GUID sorting sequence transmitted by the sending end; the receiving end uses its own RSA private key PrivKey_R2 to decrypt the encrypted GUID sorting sequence to obtain the GUID sorting sequence; According to the decrypted GUID sorting sequence, the received encrypted data blocks (B'1, B'2, ..., B't, ..., R'1, R'2, ..., R'm) are reordered to restore the order before the redundant data blocks are inserted; Remove the inserted redundant data blocks (R1, R2, ..., Rm) to obtain the encrypted data blocks (B'1, B'2, ..., B't); According to the original GUID sorting sequence, the encrypted data blocks (B'1, B'2, ..., B't) are spliced ​​to restore the complete multi-layer encrypted data Cu; Perform hash operation on the concatenated multi-layer encrypted data Cu to obtain a hash value H(Cu), and compare the calculated hash value H(Cu) with the original hash value transmitted by the sender; If the two hash values ​​are the same, the data has not been tampered with during transmission and the integrity is verified; If the two hash values ​​are different, the data has been tampered with during transmission, the integrity check fails, and the sender needs to be requested to retransmit the data; The receiver uses its own RSA private key PrivKey_R1 to decrypt the encrypted last layer key EKu: Calculate the decrypted key Ku = EKu^d' mod n', where d' is the private exponent of the RSA private key of the receiving end, and obtain the decrypted final key Ku; Decrypt each encryption layer layer by layer in the decryption order: starting from the last encryption layer, use the decrypted key Ku to decrypt the data Cu encrypted in the uth layer: Cu-1 = AES-256_Decrypt(Ku, Cu); Continue to decrypt the data Cu-1 encrypted at the u-1 layer, using the key Ku-1 at the u-1 layer: Cu-2 = AES-256_Decrypt(Ku-1, Cu-1); And so on, until the first layer of encrypted data C1 is decrypted: D = AES-256_Decrypt(K1, C1); The decryption is completed and the original plaintext data D is obtained.

5. A data encryption transmission system, used to implement a data encryption transmission method according to any one of claims 1 to 4, characterized in that: include: Encryption layer module, key module, data block module, transmission path module and decryption module; The encryption layer module divides the plaintext data into multiple encryption layers at the sending end by adopting multi-layer encryption technology, each encryption layer is encrypted using a different key of a symmetric encryption algorithm, and an independent dynamic key is set for each encryption layer; The key module is used to generate respective asymmetric key pairs at the sending end and the receiving end respectively. The sending end uses the public key of the receiving end to encrypt the key of the last layer of encryption, and transmits the encrypted key together with the multi-layer encrypted data; The data block module is used to divide the multi-layer encrypted data into data blocks of the same size, randomly arrange each data block before transmission, and add a unique identifier to each data block; at the same time, encode the data blocks to generate redundant data blocks; The transmission path module is used to construct a multi-path transmission mechanism and use a path randomization algorithm to randomly change the transmission path of the data block; The decryption module is used to splice the data blocks based on the unique identifiers of the data blocks after the receiving end receives the encrypted data, and to perform integrity and correctness verification. The receiving end uses its own private key to decrypt the key of the last layer, and then decrypts each encryption layer layer by layer in the decryption order.

6. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores a computer program that can be called by the processor; the processor executes a data encryption transmission method as described in any one of claims 1 to 4 by calling the computer program stored in the memory.

7. A computer-readable storage medium, characterized in that: Instructions are stored, and when the instructions are executed on a computer, the computer executes a data encryption transmission method as described in any one of claims 1 to 4.

Images