Data encryption and decryption method, device and computer readable storage medium

Abstract

The application discloses a data encryption and decryption method, device and computer readable storage medium, and can improve the security of real-time dynamic data. The data encryption method is applied to a first device, and the first device is used for providing real-time dynamic data for at least one second device. The data encryption method comprises the following steps: generating a private salt corresponding to the second device according to real-time dynamic service attributes corresponding to the second device; generating a public key corresponding to the real-time dynamic data; encapsulating the public key by using the private salt to generate real-time dynamic data keys corresponding to the second device; and the real-time dynamic data keys corresponding to the second device are used for encrypting the real-time dynamic data to obtain encrypted real-time dynamic data corresponding to the second device.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of mobile communication technology, and in particular to a data encryption and decryption method, device and computer readable storage medium. BACKGROUND

[0002] At present, in the 3rd Generation Partnership Project (3GPP) specification, for the 5th Generation Mobile Communication Technology (5G) broadcast service scenario, when a base station broadcasts Real-time kinematic (RTK) data, users under the same base station share the same RTK data, and when the RTK data is encrypted, the users under the same base station also use the same key for encryption. In this way, the security of the key is reduced, thereby reducing the security of the RTK data encrypted by the key. SUMMARY

[0003] The present application aims to provide a data encryption and decryption method, device and computer readable storage medium, which can improve the security of real-time dynamic data.

[0004] The technical solution of the present application is as follows:

[0005] In a first aspect, the present application provides a data encryption method applied to a first device, wherein the first device is used to provide real-time dynamic data for at least one second device, and the method comprises:

[0006] generating a private salt corresponding to the second device according to the real-time dynamic service attribute corresponding to the second device;

[0007] encapsulating a public key corresponding to the real-time dynamic data by using the private salt to generate a real-time dynamic data key corresponding to the second device; the public key is used to encrypt the real-time dynamic data to obtain encrypted real-time dynamic data; and the real-time dynamic data key is used to decrypt the encrypted real-time dynamic data by the second device.

[0008] In a second aspect, the present application provides a data decryption method applied to a second device, wherein the second device comprises any one of at least one second device connected to a first device; the first device is used to provide real-time dynamic data for the at least one second device; and the method comprises:

[0009] receiving encrypted real-time dynamic data and a real-time dynamic data key sent by the first device;

[0010] parsing the real-time dynamic data key, determining a public key and a private salt;

[0011] verifying the private salt according to real-time dynamic service attributes corresponding to the second device;

[0012] in the case of verification, decrypting the encrypted real-time dynamic data by using the public key, and determining real-time dynamic data.

[0013] In a third aspect, the present application provides a data encryption device applied to a first device, wherein the first device is used to provide real-time dynamic data for at least one second device, and the data encryption device comprises:

[0014] a generating module, used to generate a private salt corresponding to the second device according to real-time dynamic service attributes corresponding to the second device;

[0015] an encapsulating module, used to encapsulate a public key corresponding to the real-time dynamic data by using the private salt, and generate a real-time dynamic data key corresponding to the second device; the public key is used to encrypt the real-time dynamic data to obtain encrypted real-time dynamic data; and the real-time dynamic data key is used to decrypt the encrypted real-time dynamic data by the second device.

[0016] In a fourth aspect, the present application provides a data decryption device applied to a second device, wherein the second device comprises any one of at least one second device connected with a first device; the first device is used to provide real-time dynamic data for the at least one second device; and the data decryption device comprises:

[0017] a receiving module, used to receive encrypted real-time dynamic data and a real-time dynamic data key sent by the first device;

[0018] a decrypting module, used to decrypt the real-time dynamic data key, determine a public key and a private salt, verify the private salt according to real-time dynamic service attributes corresponding to the second device, and in the case of verification, decrypt the encrypted real-time dynamic data by using the public key, and determine real-time dynamic data.

[0019] In a fifth aspect, the present application provides a first device, comprising a first memory and a first processor; wherein,

[0020] the first memory is used to store executable instructions;

[0021] the first processor is used to execute the executable instructions stored in the first memory, and realize the data encryption method provided by the present application.

[0022] In a sixth aspect, the present application provides a second device, comprising a second memory and a second processor; wherein

[0023] The second memory is configured to store executable instructions.

[0024] The second processor is configured to execute the executable instructions stored in the second memory to implement the data decryption method provided by the present application.

[0025] In a seventh aspect, the present application provides a computer readable storage medium storing executable instructions, which are configured to cause a first processor to execute the data encryption method provided by the embodiments of the present application, or are configured to cause a second processor to execute the data decryption method provided by the embodiments of the present application.

[0026] In a fifth aspect, the embodiments of the present application provide a computer program product comprising a computer program or instructions, which are configured to cause a first processor to execute the data encryption method provided by the present application, or are configured to cause a second processor to execute the data decryption method provided by the present application.

[0027] The present application provides a data encryption and decryption method, device and computer readable storage medium, generates a private salt corresponding to a second device according to a real-time dynamic service attribute corresponding to the second device, encapsulates a public key by using the private salt corresponding to the second device, and generates a real-time dynamic data key corresponding to the second device. Wherein, the public key is used to encrypt real-time dynamic data to obtain encrypted real-time dynamic data, the public key is encapsulated and protected by the private salt corresponding to the second device to obtain the real-time dynamic data key, and the second device can decrypt the encrypted real-time dynamic data according to the private real-time dynamic data key, thereby meeting the private and exclusive needs of the key on the second device, improving the security of the real-time dynamic data key, and further improving the security of the real-time dynamic data. BRIEF DESCRIPTION OF DRAWINGS

[0028] Figure 1 Flowchart of the data encryption method provided by the embodiments of the present application Figure 1

[0029] Figure 2 Flowchart of the data encryption method provided by the embodiments of the present application Figure 2

[0030] Figure 3 Flowchart of the data encryption method provided by the embodiments of the present application Figure 3

[0031] Figure 4 Flowchart of the data encryption method provided by the embodiments of the present application Figure 4 ;​​​

[0032] Figure 5 A flowchart of the data decryption method provided by the embodiment of the present application Figure 1 ;

[0033] Figure 6 A flowchart of the data decryption method provided by the embodiment of the present application Figure 2 ;

[0034] Figure 7 An optional structural schematic diagram of the data encryption device provided by the embodiment of the present application

[0035] Figure 8 An optional structural schematic diagram of the data decryption device provided by the embodiment of the present application

[0036] Figure 9 An optional structural schematic diagram of the first device provided by the embodiment of the present application

[0037] Figure 10 An optional structural schematic diagram of the second device provided by the embodiment of the present application DETAILED DESCRIPTION

[0038] In order to make the objects, technical solutions and advantages of the present application clearer, the following will further describe the present application in conjunction with the accompanying drawings, and the described embodiments should not be regarded as limiting the present application, and all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present application.

[0039] In the following description, “some embodiments” are related to a subset of all possible embodiments, but it can be understood that “some embodiments” can be the same subset or different subset of all possible embodiments, and can be combined with each other without conflict.

[0040] In the following description, the terms “first\second\third” are only to distinguish similar objects, and do not represent a specific order of the objects, and it can be understood that “first\second\third” can be interchanged in a specific order or sequence as allowed, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0041] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application, and are not intended to limit the present application.

[0042] The nouns or terms involved in the embodiments of the present application are explained as follows:

[0043] 1、Salt value: Salted: In cryptography, a process of inserting a specific string at a fixed position in a password to make the hash result inconsistent with the hash result using the original password. This process is called "salting". The "salt value" is a set of random strings, called Salt, randomly generated by the system. Salt can be inserted at the beginning, end, or middle, and can be inserted separately or in reverse order. Adding Salt to the password makes the encrypted ciphertext more obscure and less likely to be queried. Even if the attacker queries the value, it is the password with Salt, not the user's password.

[0044] 2、RTCM: RTCM SC10403.3 protocol developed by Radio Technical Commission for Maritime services, referred to as RTCM 3.3 protocol, which provides differential correction data for mobile stations in satellite navigation systems to improve their positioning accuracy.

[0045] 3、RTCM commonly used messages are 1005, 1074, 1084, 1094, 1114, 1124.

[0046] 1005: Provides ECEF position of reference station antenna (antenna reference point (ARP)) and quarter phase alignment details, and provides GNSS RTK observation auxiliary data for the fixed reference station together with the reference station antenna description.

[0047] 1074: GPS pseudorange observation, phase observation and CNR information.

[0048] 1084: GLONASS pseudorange observation, phase observation and CNR information.

[0049] 1094: Galileo pseudorange observation, phase observation and CNR information.

[0050] 1114: QZSS pseudorange observation, phase observation and CNR information.

[0051] 1124: BDS pseudorange observation, phase observation and CNR information.

[0052] Currently, chapter 7.5 of 3GPP specification 38.305 and chapter 6.14.1 of 23.273 make relevant provisions for data completeness guarantee:

[0053] RTK encryption: If the message in RTK needs to be encrypted, the RTK can be encrypted using the Advanced Encryption Standard (AES); because users under the same base station share the same RTK data, users under the same base station need to share the same key.

[0054] Data segmentation: When the length of the RTK message content exceeds the length limit of the positioning system message block (posSIB), segmentation needs to be performed according to the length limit of the posSIB, but the segmented content is not protected.

[0055] It can be seen that in the broadcast service scenario, the same base station broadcasts the same RTK data, and the same base station broadcasts the same RTK data, such as using the AES algorithm specified in the specification, and the same base station under the same base station. Users must use the same key, and the user's key exclusive requirement cannot be met, thereby reducing the security of the RTK data. Moreover, the protocol standard specification specifies that segmentation can be performed according to the length limit, and the segmented content is not protected, thereby reducing the completeness and consistency of the RTK data transmission. 5G broadcast service has the advantages of protecting user location privacy and saving platform expansion cost compared with user plane unicast, but due to the same base station under the same base station. The RTK data received by the terminal at the same time is the same, and it is particularly important to protect the data security.

[0056] The embodiment of the present application provides a data encryption and decryption method, device and computer readable storage medium, which can improve the security of RTK data. The data encryption method of the embodiment of the present application is applied to a first device, and the first device is used for providing real-time dynamic (RTK) data for at least one second device. In some embodiments, the first device can include a server or a base station, and the second device can include a terminal. Exemplarily, the first device can include a reference station in an RTK system, such as a fixed station, a reference station and the like, or the first device can include a relay station, an access point, a vehicle-mounted device, a wearable device, a network device in a 5G network or a network device in a future evolved public land mobile network (PLMN) network, etc., for example, a transmission point (TRP or TP) in a new radio (NR) system, a base station (gNB) in an NR system, one or a group of antenna panels (including multiple antenna panels) of a base station in a 5G system, etc. The second device can include a user equipment (UE), an access terminal, a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a terminal, a wireless communication device, a user agent or a user device. The access terminal can be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a handheld device with wireless communication function, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a drone device, and a terminal device in a 5G network or a terminal device in a future evolved PLMN, etc., and the embodiment of the present application is not limited thereto.

[0057] The data encryption method of the embodiment of the present application can be as shown in Figure 1 , including S101-S102, as follows:

[0058] S101, generating a private salt corresponding to the second device according to the real-time dynamic service attribute corresponding to the second device.

[0059] In the embodiment of the present application, the first device is connected with at least one second device, and the first device sends real-time dynamic (RTK) data determined based on the received or observed satellite data to the at least one second device in a broadcast manner through receiving or observing satellite data; the at least one second device determines its own position information through real-time difference operation according to the relative positioning principle by combining the RTK data provided by the first device with the satellite data observed or received by the second device, so as to realize its own positioning. Wherein, the RTK data provided by the same first device for the at least one second device at the same time is the same.

[0060] In the embodiment of the present application, the second device can include at least one second device, one or more second devices. The first device can generate the private salt corresponding to each second device according to the real-time dynamic service attribute corresponding to each second device according to the data encryption method in the embodiment of the present application, and then generate the real-time dynamic data key corresponding to each second device. In the following, taking the generation of the real-time dynamic data key corresponding to any second device as an example, the real-time dynamic data key corresponding to each second device can be generated according to the same process.

[0061] In S101, the first device can generate the private salt corresponding to the second device according to the real-time dynamic service attribute corresponding to the second device. Here, the private salt is used to encrypt the public key corresponding to the broadcast real-time dynamic data, so as to determine the real-time dynamic data key corresponding to the second device, so that the exclusive key requirement of different terminals can be met in the broadcast scenario.

[0062] In the embodiment of the present application, the real-time dynamic service attribute corresponding to the second device can include the configuration parameter of the real-time dynamic service configured on the second device, which is used to represent the service requirement of the real-time dynamic service of the second device, such as positioning accuracy requirement and / or broadcast frequency requirement, etc. The specific selection is made according to the actual situation, and the embodiment of the present application is not limited.

[0063] In some embodiments, the real-time dynamic service attribute corresponding to the second device includes at least one of the real-time dynamic data length, the broadcast delay and the broadcast frequency configured by the second device.

[0064] The real-time dynamic data length configured by the second device is used to represent the positioning accuracy requirement of the second device. Here, the positioning accuracy requirement mainly depends on the constellation and the amount of frequency band data, and is reflected in the size of the RTK data length. The broadcast delay includes the time delay from the first device broadcasting the RTK data to the second device receiving the RTK data. Specifically, it includes the time delay from the first device broadcasting the RTK data to the second device's solving module receiving the RTK data. The broadcast frequency includes the frequency of the first device broadcasting the RTK data to the second device. Exemplarily, the maximum broadcast frequency can be 1 time / 1 second, and the minimum frequency can be 1 time / 30 seconds.

[0065] It can be understood that the real-time dynamic service attribute corresponding to the second device is a customized attribute parameter on the second device. The private salt is generated based on the real-time dynamic service attribute corresponding to the second device to encrypt the public key, which can ensure the privacy and exclusivity of the key and improve the encryption security.

[0066] In S102, the public key corresponding to the real-time dynamic data is encapsulated by using the private salt to generate the real-time dynamic data key corresponding to the second device.

[0067] In the embodiment of the application, the public key is used by the first device to encrypt the real-time dynamic data to obtain encrypted real-time dynamic data. Here, since the RTK data provided by the first device for at least one second device at the same time is the same, the first device encrypts the RTK data by using the public key to obtain encrypted real-time dynamic data, which is sent to at least one second device in the form of broadcast. The process of determining the encrypted real-time dynamic data by the first device using the public key to encrypt the real-time dynamic data can be performed in any order or in parallel with S101 and S102, and the embodiment of the application does not make specific limitation.

[0068] In the embodiment of the application, the first device encapsulates the public key used to encrypt the real-time dynamic data by using the private salt corresponding to the second device to generate the real-time dynamic data key corresponding to the second device. That is, the real-time dynamic data key corresponding to the second device is a double-layer structure of the private salt and the public key.

[0069] In some embodiments, the first device adds the device identifier corresponding to the second device to the head of the public key to determine the first initial key; adds the private salt corresponding to the second device to the tail of the first initial key to determine the second initial key; and encrypts the second initial key to generate the real-time dynamic data key corresponding to the second device.

[0070] In the embodiment of the application, in the case that the real-time dynamic data is determined to be encrypted and the real-time dynamic data key corresponding to the second device is generated, the first device broadcasts the encrypted real-time dynamic data and the real-time dynamic data key corresponding to the second device to at least one second device. In this way, in the case that the second device receives the encrypted real-time dynamic data and the real-time dynamic data key corresponding to the second device, the second device can parse the public key from the real-time dynamic data key through inverse operation, and then decrypt the encrypted real-time dynamic data through the public key, and then realize positioning according to the decrypted real-time dynamic data.

[0071] It should be noted that the first device can generate a plurality of real-time dynamic data keys corresponding to a plurality of second devices through the method in S101-S102, and broadcast the plurality of real-time dynamic data keys and the encrypted real-time dynamic data to the plurality of second devices. Each second device in the plurality of second devices parses the public key according to the real-time dynamic data key corresponding to the second device, and decrypts the encrypted real-time dynamic data according to the public key.

[0072] It can be understood that the private salt corresponding to the second device is generated according to the real-time dynamic service attribute corresponding to the second device, and the public key is encapsulated by using the private salt corresponding to the second device to generate the real-time dynamic data key corresponding to the second device. The public key is used to encrypt the real-time dynamic data to obtain the encrypted real-time dynamic data. The public key is encapsulated and protected by the private salt corresponding to the second device to obtain the real-time dynamic data key. The second device can decrypt the encrypted real-time dynamic data according to the private real-time dynamic data key, thereby meeting the private and exclusive needs of the key on the second device, improving the security of the real-time dynamic data key, and further improving the security of the real-time dynamic data.

[0073] In some embodiments, the generation of the private salt corresponding to the second device according to the real-time dynamic service attribute corresponding to the second device in S101 can be implemented through the following process, including:

[0074] According to a first preset correspondence relationship between the first salt value and the real-time dynamic data length range, a target first salt value corresponding to the real-time dynamic data length configured by the second device is determined;

[0075] And / or,

[0076] According to a second preset correspondence relationship between the second salt value and the broadcast delay range, a target second salt value corresponding to the broadcast delay configured by the second device is determined;

[0077] And / or,

[0078] According to a third preset correspondence relationship between the third salt value and the broadcast frequency range, a target third salt value corresponding to the broadcast frequency configured by the second device is determined;

[0079] generate the private salt according to at least one of the target first salt value, the target second salt value, and the target third salt value.

[0080] In the embodiments of the present application, a first preset correspondence between a real-time dynamic data length range and a first salt value can be preconfigured or defined on the first device. In some embodiments, the first preset correspondence includes a correspondence between at least one preset real-time dynamic data length range and at least one first preset salt value. In this way, the target first salt value can be determined according to the real-time dynamic data length configured by the second device and in combination with the first preset correspondence.

[0081] For example, the precision requirement can be divided into m levels according to the RTK data length range, and the corresponding salt values are a1_salt, a2_salt, …, a m _salt, that is, a correspondence between at least one preset real-time dynamic data length range and at least one first preset salt value. For example, the first preset salt value a1_salt corresponds to the preset RTK data length range 0B to 100B, the first preset salt value a2_salt corresponds to the preset RTK data length range 100B to 200B, and so on, and the first preset salt value a m _salt corresponds to the preset RTK data length range [100*(m-1)]B to (100*m)B, and so on. The specific selection is not limited in the embodiments of the present application.

[0082] In the embodiments of the present application, a second preset correspondence between a broadcast delay range and a second salt value can be preconfigured or defined on the first device. In some embodiments, the second preset correspondence includes a correspondence between at least one preset broadcast delay range and at least one second preset salt value. In this way, the target second salt value can be determined according to the broadcast delay configured by the second device and in combination with the second preset correspondence.

[0083] For example, the broadcast delay can be divided into n levels according to the delay range, and the corresponding salt values are b1_salt, b2_salt, …, b n _salt, that is, a correspondence between at least one preset broadcast delay range and at least one second preset salt value. For example, the second preset salt value b1_salt corresponds to the preset delay range 0ms to 100ms, the second preset salt value b2_salt corresponds to the preset delay range 100ms to 200ms, and so on, and the second preset salt value b n _salt corresponds to the preset delay range [100*(n-1)]ms to (100*n)ms, and so on. The specific selection is not limited in the embodiments of the present application.

[0084] In this embodiment of the invention, a third preset correspondence between a broadcast frequency range and a third salt value can be pre-configured or defined on the first device. In some embodiments, the third preset correspondence includes a correspondence between at least one preset broadcast frequency range and at least one third preset salt value. Thus, the target third salt value can be determined based on the broadcast frequency configured on the second device and the third preset correspondence.

[0085] For example, the broadcast frequency can be divided into k levels according to the broadcast frequency range, with corresponding salt values ​​c1_salt, c2_salt, ..., c k `_salt` defines the correspondence between at least one preset broadcast frequency range and at least one third preset salt value. For example, the third preset salt value `c1_salt` corresponds to a preset broadcast frequency of 1 time / 1 second, the third preset salt value `c2_salt` corresponds to a preset broadcast frequency of 1 time / 2 seconds, and so on. k _salt corresponds to a preset broadcast frequency of 1 time / k seconds, etc. Here, we take a third preset salt value corresponding to a preset broadcast frequency value as an example. A third preset salt value can also correspond to a preset broadcast range. The specific selection depends on the actual situation, and the embodiments of the present invention do not limit it.

[0086] In some embodiments, at least one of a target first salt value, a target second salt value, and a target third salt value can be determined through the above process. Then, a private salt corresponding to the second device is generated based on at least one of the target first salt value, the target second salt value, and the target third salt value. For example, the target first salt value is a. i _salt, indicating that the accuracy requirement level corresponding to the second device is i; the target second salt value is b. j _salt indicates that the broadcast delay level corresponding to the second device is level j; the target third salt value is c. k _salt represents the broadcast frequency level k corresponding to the second device. The first device generates a private salt private_salt by combining the target first salt value, the target second salt value, and the target third salt value; where private_salt = a i _salt+b j _salt+c k _salt.

[0087] Understandably, generating a private salt corresponding to the second device based on its real-time dynamic business attributes satisfies the need for exclusive and proprietary keys in broadcast scenarios, thereby improving the security of RTK data.

[0088] In some embodiments, the first device generates a public key for broadcasting real-time dynamic data. Embodiments of the present application do not limit the manner in which the first device generates the public key.

[0089] In some embodiments, embodiments of the present application also provide a method for generating a public key, comprising: a first device generating an initial public key; and generating a public key by salting the initial public key. Exemplarily, the initial public key can be generated in a random manner.

[0090] In some embodiments, the process in which the first device generates the public key by salting the initial public key can comprise:

[0091] The first device determines a public salt according to the random string and the broadcast service identifier, and generates the public key by salting the initial public key using the public salt. Exemplarily, a 20-bit public salt can be generated according to a 16-bit random string and a 4-bit 5G broadcast service identifier.

[0092] In some embodiments, the first device can determine the initial public key by salting the initial public key using the public salt, incrementally process the initial public key to determine an initial incremental public key, and exclusive-OR the initial incremental public key to determine the public key.

[0093] Exemplarily, the process in which the first device generates the public key can be as shown in Figure 2 as follows:

[0094] S201, randomly generating a 32-bit string as an initial public key.

[0095] Exemplarily, the first device can randomly generate a 32-bit American Standard Code for Information Interchange (ASCII) string str1 as the initial public key.

[0096] S202, salting the initial public key using a 20-bit public salt to obtain a salted string as an initial salted public key.

[0097] In S202, the first device performs a salting operation on str1 using a 20-bit public salt (a 16-bit random string and a 4-bit 5G broadcast service identifier) public_salt to obtain a salted string str2 as an initial salted public key; wherein str2=str1+public_salt.

[0098] S203, converting the initial salted public key into a character array.

[0099] Exemplarily, the first device converts str2 into an ASCII code character array charArr.

[0100] S204, an increment is added to the character array to obtain an initial increment public key.

[0101] Exemplarily, the first device takes out the characters of the character array charArr one by one as charArr[pos], and adds an increment v to the ASCII code corresponding to charArr[pos] to obtain the initial increment public key. Exemplarily, the increment v can be a preset value, such as 77, or the increment v can be generated according to the real-time dynamic service attribute of the second device. Exemplarily, the increment v is determined according to the real-time dynamic data length configured on the second device, and a preset corresponding relationship between the range of the real-time dynamic data length and the preset increment. Or, the increment v is determined according to the broadcast delay configured on the second device, and a preset corresponding relationship between the range of the broadcast delay and the preset increment. Or, the increment v is determined according to the broadcast frequency configured on the second device, and a preset corresponding relationship between the range of the broadcast frequency and the preset increment. In order to generate the initial increment public key in combination with the real-time dynamic service attribute of the second device, and further generate the public key, thereby improving the security of the key. The specific selection is selected according to the actual situation, and the embodiment of the application is not limited.

[0102] S205, the initial increment public key is subjected to XOR modulo operation to obtain the public key.

[0103] In S205, considering that the initial increment public key charArr[pos]+v may be greater than 256, that is, it exceeds the ASCII code range, therefore, the initial increment public key can be subjected to XOR modulo operation, that is, charArr[pos]=(charArr[pos]+v)%256. The device converts charArr[pos] into a string to obtain the public key public_key.

[0104] It can be understood that by performing the salt processing on the public key, the security of the public key is improved, and the security of encrypting the real-time dynamic data by using the public key is further improved.

[0105] In some embodiments, based on Figure 2In the case that the public key corresponds to the private salt of the second device, 11-bit user identification (device identification corresponding to the second device) can be added in front of the public key (header of the public key) to obtain key1 (first initial key); the private salt private_salt corresponding to the second device can be added behind key1 (tail of the first initial key) to obtain key2 (second initial key); and key2 can be subjected to md5 encryption to obtain the real-time dynamic data key private_key corresponding to the second device.

[0106] It can be understood that, by the method in the embodiment of the application, the private salt generation rule is designed according to the real-time dynamic service attribute of different second devices, i.e., different users, and the private salt corresponding to different users is generated according to the private salt generation rule; the public salt is generated, the public key is generated by adding the public salt and performing exclusive or operation and taking the remainder, and the real-time dynamic data key is generated by encapsulating the private salt in the outer layer of the public key. In this way, each second device, i.e., each user, under the same base station can enjoy the key, thereby improving the security of the RTK data.

[0107] In some embodiments, the real-time dynamic data at least includes data of at least one first message type. The data encryption method provided by the embodiment of the application can also include S301-S304, as shown in the following. Figure 3

[0108] S301, based on the preset system message quantity of the broadcast cycle, segmenting the data of at least one first message type to determine a plurality of data segments.

[0109] In S301, the RTK data contains data of one or more message types; in some embodiments, the message type can include a first message type and / or a second message type. The first message type represents a message type supporting data segmentation, and the second message type represents a message type not supporting data segmentation. Exemplarily, the first message type can include a multiple signal message (MSM) message type; and the second message type can include an antenna message type. The antenna message type can include at least one of a 1005 message type, a 1006 message type, a 1007 message type, and a 1008 message type, and the corresponding message length is 0-100 bytes. The data of the MSM message type contains a data message header and a data message body, the length of the data message header is 0-100 bytes; and the data message body is the actual content of GNSS pseudorange and carrier phase plus signal strength, and the length of the data message body is 0-300 bytes. The first message type and the second message type can also include other message types, which are selected according to actual conditions, and the embodiment of the application is not limited.

[0110] ​In some embodiments, the first message type includes at least one first message sub-type. Exemplarily, the MSM type message mainly includes five messages, i.e., 1074, 1084, 1094, 1114 and 1124, which correspond to the pseudoranges and carrier phase plus signal strength of GPS, GLONASS, Galileo, QZSS and BDS respectively. In the embodiments of the present application, the first device can perform adaptive segmentation on the data of the first message type in the RTK data according to the preset number of system messages of the broadcast period, and perform type labeling on the obtained multiple data segments according to the at least one first message sub-type, to obtain each data segment and the type label corresponding to each data segment. Each data segment and the type label corresponding to each data segment are filled into the system message, and the multiple system messages obtained thereby are sent to the at least one second device by using the broadcast period, so as to ensure that the complete RTK data is broadcast in one broadcast period.

[0111] Exemplarily, according to the protocol specification, one broadcast period can be divided into 8 time windows, and one SI is sent in each time window, so that each broadcast period can carry 8 system messages (SI). Since 2 SIs are reserved for other broadcast data, at most 6 SIs can be used for RTK data, so 6 can be taken as the preset number of system messages. It can be seen that the preset number of system messages represents the number of available system messages corresponding to the RTK data.

[0112] It should be noted that according to the protocol specification, different types of information cannot be carried in each SI, i.e., only one of the data of the antenna message type, the message header of the MSM message type and the message body of the MSM message type can be carried in one SI.

[0113] In some embodiments, two segmentation standards are configured on the first device, corresponding to two preset segmentation lengths, i.e., a first preset segmentation length and a second preset segmentation length. Exemplarily, the first preset segmentation length (limit1) can be 80 bytes, which is the standard segmentation length of the base station, and each SI contains at most 4 data segments. The second preset segmentation length (limit2) can be 320 bytes, which is the maximum length of the system message specified in the 3GPP specification, and each SI contains one data segment.

[0114] In S301, the first device segments the data of the at least one first message type according to the first preset segmentation length or the second preset segmentation length based on the preset number of system messages of the broadcast period, to determine multiple data segments.

[0115] In some embodiments, since only the same type of information can be carried in one system message, the number of system messages occupied by the data of the second message type needs to be considered. The first device can determine the number of remaining system messages according to the preset number of system messages and the number of system messages occupied by the data of the at least one second message type; for example, the number of remaining system messages is determined by subtracting the number of system messages occupied by the data of the at least one second message type from the preset number of system messages; the first device segments the data of the at least one first message type according to the number of remaining system messages to determine a plurality of data segments.

[0116] In some embodiments, the data of the first message type can include a data message header and a data message body. Since only the same type of information can be carried in one system message, the first device determines the data message header corresponding to the data of the at least one first message type as a data segment, and updates the number of remaining system messages; the data segment corresponding to the data message header occupies one system message. That is, the number of system messages occupied by the data message header is subtracted from the number of remaining system messages, and the updated number of remaining system messages is used for the data segment of the data message body.

[0117] In some embodiments, the segmentation process of the first device for the data message body can include:

[0118] In the case where the number of remaining system messages is greater than the preset message number threshold, the data message body corresponding to the data of the at least one first message type is segmented according to the first preset segmentation length or the second preset segmentation length to determine at least one data segment.

[0119] In the case where the number of remaining system messages is equal to the preset message number threshold, and the number of data of the at least one first message type is less than or equal to the preset message number threshold, the data message body corresponding to the data of the at least one first message type is segmented according to the first preset segmentation length or the second preset segmentation length to determine at least one data segment.

[0120] In the case where the number of remaining system messages is equal to the preset message number threshold, and the number of data of the at least one first message type is greater than the preset message number threshold, the data message body corresponding to the data of the at least one first message type is segmented according to the first preset segmentation length to determine at least one data segment; the first preset segmentation length is less than the second preset segmentation length.

[0121] The first device obtains the at least one data segment corresponding to the data message body according to the above process, and determines the plurality of data segments according to the data segment corresponding to the data message header and the at least one data segment corresponding to the data message body. That is, the data segment corresponding to the data message header and the at least one data segment corresponding to the data message body are determined as the plurality of data segments.

[0122] Exemplarily, taking the first electric message type as the MSM electric message type as an example, the process of segmenting the data of the at least one MSM electric message type by the first device can be as shown in Figure 4

[0123] S401, determining m remaining system messages according to the number of system messages occupied by the data of the antenna electric message type.

[0124] In S401, the first device parses the RTK data, and if there is an antenna type electric message, the antenna type electric message is taken out, occupying one of the available 6 SIs, to obtain m remaining system messages (m=5). If not, it does not occupy (m=6).

[0125] S402, determining n remaining system messages according to the number of system messages occupied by the data message header of the data of the at least one multi-signal electric message type in the m remaining system messages.

[0126] In S402, the first device can take out the data message header of the data of the at least one MDM electric message type, occupying at least one system message, at which time n SIs are available. Exemplarily, the first device removes the data message header of the MDM electric message type, occupying one SI, and leaving n SIs.

[0127] S403, determining whether n is greater than 4.

[0128] In S403, 4 is a preset message quantity threshold. If n is greater than 4, S404 is executed; if n is equal to 4, S405 is executed.

[0129] S404, segmenting the data message body of the at least one multi-signal electric message type according to the first preset segment length or the second preset segment length to obtain at least one data segment.

[0130] In S404, the first device can segment the data message body of the at least one multi-signal electric message type to obtain at least one data segment by using the Limit1 segmentation standard or the Limit2 segmentation standard.

[0131] S405, determining whether the number of multi-signal electric message types is less than or equal to 4.

[0132] ​In S405, the first device determines whether the number of data of the MSM message type is less than or equal to 4, if yes, S404 is executed; if no, S406 is executed.

[0133] In S406, the data message body of at least one multi-signal message type is segmented according to the first preset segment length, and at least one data segment is obtained.

[0134] In S405-S406, if n=4 and the number of data of the MSM message type is less than or equal to 4, both limit1 and limit2 can be used; if n=4 and the number of data of the MSM message type is greater than 4, limit1 must be used for segmentation, and the MSM message body is combined into SI.

[0135] In S302, according to at least one first message sub-type included in the first message type, a plurality of type tags corresponding to a plurality of data segments are determined.

[0136] In S302, the first message type includes at least one first message sub-type. Each first message sub-type in the at least one first message sub-type corresponds to a preset type tag. The type tag corresponding to the data segment is used to identify the first message sub-type of the data segment. The first device can determine the type tag of the data segment corresponding to the data message header of the same first message sub-type and the type tag of the data segment corresponding to the data message body as the preset type tag corresponding to the first message sub-type, thereby determining a plurality of type tags corresponding to a plurality of data segments. That is, the first device sets the same type tag for the data message header and the data message body of the same first message sub-type, so as to ensure that the second device can assemble the data message header and the segmented data message body after receiving the segmentation.

[0137] Exemplarily, the initial value of the type tag valuetag is set as tag0; for the five sub-types included in the MSM message type: GPS, GLONASS, Galileo, QZSS and BDS, the type tags can be set as follows:

[0138] The type tag valuetag corresponding to GPS is tag0+1;

[0139] The type tag valuetag corresponding to GLONASS is tag0+2;

[0140] The type tag valuetag corresponding to Galileo is tag0+3;

[0141] The type tag valuetag corresponding to QZSS is tag0+4;

[0142] The type tag corresponding to the BDS is value tag=tag0+5.

[0143] S303, in combination with the plurality of data segments and the plurality of type tags, determine a plurality of system messages.

[0144] In the embodiment of the application, the first preset segment length corresponds to a first preset segment number; and the second preset segment length corresponds to a second preset segment number. Here, the first preset segment number and the second preset segment number represent a data segment number threshold in a system message. For example, for the limit1 segment standard, the first preset segment length is 80 bytes, and the first preset segment number is 4, that is, each system message includes at most 4 data segments. For the limit2 segment standard, the first preset segment length is 320 bytes, and the second preset segment number is 1, that is, each system message includes at most 1 data segment.

[0145] In S303, the first device determines a first preset segment number or a second preset segment number according to the first preset segment length or the second preset segment length for data segmenting the data message body of the first message type. According to the first preset segment number or the second preset segment number, a system message is obtained according to the corresponding number of data segments and the type tag corresponding to each data segment, so that a plurality of system messages can be determined in combination with the plurality of data segments and the plurality of type tags. For example, the first device can encapsulate the data segments and the corresponding type tags into NR positioning protocol (NRPPa) instructions.

[0146] S304, encrypting the plurality of system messages by using a public key to determine encrypted real-time dynamic data.

[0147] In S304, the first device encrypts the plurality of system messages by using a public key to obtain encrypted system messages. The first device can determine the encrypted system messages as encrypted real-time dynamic data, or, in the case that the real-time dynamic data includes data of at least one second message type, can encrypt the system messages occupied by the data of the second message type by using the public key, and combine the above-mentioned encrypted system messages as encrypted real-time dynamic data to be sent to at least one second device.

[0148] It can be understood that, by adaptive segmenting and type tagging according to the message type, the second device can combine the data segment contents of the same message type according to the type tags of the received data segments, thereby improving the consistency of RTK data transmission.

[0149] Based on the above-mentioned data encryption method provided by the embodiment of the application, the embodiment of the application provides a data decryption method, which is applied to a second device, such as Figure 5As shown, the following:

[0150] S501, receiving the encrypted real-time dynamic data and the real-time dynamic data key sent by the first device.

[0151] In S501, the second device receives the encrypted real-time dynamic data and the real-time dynamic data key sent by the first device.

[0152] It should be noted that the real-time dynamic data key is generated according to the data encryption method in the embodiment of the application, which will not be described here. In the case where the second device receives the encrypted real-time dynamic data and the at least one real-time dynamic data key broadcast by the first device, it can be determined whether it is the real-time dynamic data key corresponding to itself according to the user identifier contained in each real-time dynamic data key in the at least one real-time dynamic data key. In the case of determining that it is the real-time dynamic data key corresponding to itself, the decryption of the real-time dynamic data key and the decryption of the encrypted real-time dynamic data are performed.

[0153] S502, decrypting the real-time dynamic data key to determine the public key and the private salt.

[0154] In the embodiment of the application, the real-time dynamic data key is a double-layer structure in which the private salt is encapsulated and encrypted to the public key. The second device decrypts the real-time dynamic data key, and exemplarily, MD5 decrypts the real-time dynamic data key obtained by MD5 encryption to obtain the public key and the private salt in the real-time dynamic data key.

[0155] S503, verifying the private salt according to the real-time dynamic service attribute corresponding to the second device, and in the case where the verification is passed, decrypting the encrypted real-time dynamic data by using the public key to determine the real-time dynamic data.

[0156] In the embodiment of the application, the second device verifies the private salt according to the real-time dynamic service attribute corresponding to itself. Exemplarily, the second device can generate the private salt corresponding to itself according to the real-time dynamic service attribute corresponding to itself, according to the same private salt process as the first device, compare the private salt corresponding to itself with the private salt decrypted from the real-time dynamic data key, and in the case where the comparison is consistent, determine that the verification is passed, otherwise, determine that the verification is not passed.

[0157] That is, the second device can determine the validity of the real-time dynamic data key by verifying whether the real-time dynamic service attribute represented by the private salt decrypted from the real-time dynamic data key is consistent with the real-time dynamic service attribute corresponding to itself, and in the case where the real-time dynamic data key is valid, the public key in the real-time dynamic data key is valid, and then the next decryption operation can be performed by using the public key decrypted from the real-time dynamic data key.

[0158] In the embodiment of the present application, in the case of verification passing, the second device decrypts the encrypted real-time dynamic data by using the public key, determines the real-time dynamic data, and then realizes self-positioning based on the real-time dynamic data.

[0159] It can be understood that the second device verifies the private salt in the real-time dynamic data key by using the real-time dynamic service attribute corresponding to the second device, ensures the privacy and exclusivity of the real-time dynamic data key, and decrypts the encrypted real-time dynamic data by using the public key in the case of verification passing, thereby further improving the security of the real-time dynamic data.

[0160] In some embodiments, the encrypted real-time dynamic data includes encrypted multiple system messages, and the real-time dynamic data at least includes data of at least one first message type. The process of decrypting the encrypted real-time dynamic data by using the public key in S503 to determine the real-time dynamic data can be as shown in the following table. Figure 6

[0161] S601, decrypt the encrypted real-time dynamic data by using the public key to determine the multiple system messages corresponding to the first message type.

[0162] In the embodiment of the present application, corresponding to the data segmentation process on the first device, the second device decrypts the encrypted real-time dynamic data by using the public key, and can determine the multiple system messages corresponding to the first message type. The first message type includes at least one first message sub-type, the multiple system messages include a system message corresponding to a data message header of the first message type and at least one system message corresponding to a data message body of the first message type, each system message in the multiple system messages includes at least one data segment and a type mark corresponding to each data segment in the at least one data segment, and the type mark is used to identify the first message sub-type of the data segment.

[0163] S602, determine the data of at least one first message type by combining the data segments with the same type mark.

[0164] In S602, the second device combines the data segments with the same type mark according to the type mark of each data segment, determines the data of one first message type by combining the data segments with the same type mark, and determines the data of at least one first message type.

[0165] It can be understood that by combining the data segments by using the type mark, the second device can combine the data segment contents of the same message type according to the type mark of the received data segment, thereby improving the consistency of the RTK data transmission.

[0166] ​The embodiment of the present application also provides a data encryption device, which is applied to a first device, Figure 7 A structural schematic diagram of the data encryption device provided by the embodiment of the present application is shown in the figure. Figure 7 As shown in the figure, the data encryption device 1 comprises a generating module 11 and an encapsulating module 12, wherein:

[0167] The generating module 11 is configured to generate a private salt corresponding to a second device according to real-time dynamic service attributes corresponding to the second device.

[0168] The encapsulating module 12 is configured to encapsulate a public key corresponding to real-time dynamic data by using the private salt, so as to generate a real-time dynamic data key corresponding to the second device; the public key is used to encrypt the real-time dynamic data to obtain encrypted real-time dynamic data; and the real-time dynamic data key is used to decrypt the encrypted real-time dynamic data by the second device.

[0169] In some embodiments, the real-time dynamic service attributes comprise at least one of:

[0170] a real-time dynamic data length, a broadcast delay and a broadcast frequency configured by the second device.

[0171] In some embodiments, the generating module 11 is further configured to determine a target first salt value corresponding to the real-time dynamic data length configured by the second device according to a first preset corresponding relationship between a real-time dynamic data length range and a first salt value; and / or determine a target second salt value corresponding to the broadcast delay configured by the second device according to a second preset corresponding relationship between a broadcast delay range and a second salt value; and / or determine a target third salt value corresponding to the broadcast frequency configured by the second device according to a third preset corresponding relationship between a broadcast frequency range and a third salt value; and generate the private salt according to at least one of the target first salt value, the target second salt value and the target third salt value.

[0172] In some embodiments, the first preset corresponding relationship comprises a corresponding relationship between at least one preset real-time dynamic data length range and at least one first preset salt value; the second preset corresponding relationship comprises a corresponding relationship between at least one preset broadcast delay range and at least one second preset salt value; and the third preset corresponding relationship comprises a corresponding relationship between at least one preset broadcast frequency range and at least one third preset salt value.

[0173] In some embodiments, the generating module 11 is further configured to generate an initial public key; and generate the public key by performing a salting operation on the initial public key.

[0174] In some embodiments, the generating module 11 is further configured to generate a public salt according to the random string and the broadcast service identifier; and generate the public key by performing a salting operation on the initial public key using the public salt.

[0175] In some embodiments, the generating module 11 is further configured to determine an initial public key by performing a salting operation on the initial public key using the public salt; determine an initial incremental public key by performing an incremental operation on the initial public key; and determine the public key by performing an exclusive or operation on the initial incremental public key.

[0176] In some embodiments, the packaging module 12 is further configured to determine a first initial key by adding a device identifier corresponding to the second device to a header of the public key; determine a second initial key by adding the private salt to a tail of the first initial key; and generate a real-time dynamic data key corresponding to the second device by encrypting the second initial key.

[0177] In some embodiments, the data encryption apparatus 1 further comprises an encryption module and a broadcast module; the encryption module is configured to encrypt the real-time dynamic data using the public key to determine the encrypted real-time dynamic data;

[0178] The broadcast module is configured to broadcast the encrypted real-time dynamic data and the real-time dynamic data key corresponding to the second device to the at least one second device.

[0179] In some embodiments, the real-time dynamic data at least includes data of at least one first message type; the data encryption apparatus 1 further comprises a segmentation module and an encryption module; the segmentation module is configured to determine a plurality of data segments by performing data segmentation on the data of the at least one first message type based on a preset number of system messages of a broadcast cycle; determine a plurality of type markers corresponding to the plurality of data segments according to at least one first message sub-type included in the first message type; and determine a plurality of system messages in combination with the plurality of data segments and the plurality of type markers.

[0180] The encryption module is configured to encrypt the plurality of system messages using the public key to determine the encrypted real-time dynamic data.

[0181] In some embodiments, the real-time dynamic data further includes data of at least one second message type; and the segmentation module is further configured to determine a remaining number of system messages according to the preset number of system messages and a number of system messages occupied by the data of the at least one second message type; and determine the plurality of data segments by segmenting the data of the at least one first message type according to the remaining number of system messages.

[0182] In some embodiments, the segmenting module is further configured to determine a data message header corresponding to the at least one first electric text type of data as a data segment, and update the remaining system message quantity; the data segment corresponding to the data message header occupies one system message; in a case where the remaining system message quantity is greater than a preset message quantity threshold, segment a data message body corresponding to the at least one first electric text type of data according to a first preset segment length or a second preset segment length to determine at least one data segment; in a case where the remaining system message quantity is equal to the preset message quantity threshold and a quantity of the at least one first electric text type of data is less than or equal to the preset message quantity threshold, segment the data message body corresponding to the at least one first electric text type of data according to the first preset segment length or the second preset segment length to determine at least one data segment; in a case where the remaining system message quantity is equal to the preset message quantity threshold and the quantity of the at least one first electric text type of data is greater than the preset message quantity threshold, segment the data message body corresponding to the at least one first electric text type of data according to the first preset segment length to determine at least one data segment; the first preset segment length is less than the second preset segment length; and determine the plurality of data segments according to the data segment corresponding to the data message header and the at least one data segment corresponding to the data message body.

[0183] In some embodiments, the segmenting module is further configured to mark a type of the data segment corresponding to the data message header and the data message body of the same first electric text sub-type as a preset type mark corresponding to the first electric text sub-type, so as to determine a plurality of type marks corresponding to the plurality of data segments.

[0184] In some embodiments, the first electric text type represents an electric text type supporting data segmenting, and the first electric text type at least includes a multi-signal electric text type; the second electric text type represents an electric text type not supporting data segmenting, and the second electric text type at least includes an antenna electric text type.

[0185] It should be noted that the above description of the device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects to the method embodiments. For technical details not disclosed in the device embodiments of the present application, please refer to the description of the data encryption method embodiments of the present application for understanding.

[0186] The embodiments of the present application also provide a data decryption device, which is applied to a second device, Figure 8 A structural schematic diagram of the data decryption device provided by the embodiments of the present application is shown in FIG. 2. Figure 8 As shown in FIG. 2, the data decryption device 2 includes a receiving module 21 and a decryption module 22, wherein:

[0187] The receiving module 21 is configured to receive the encrypted real-time dynamic data and the real-time dynamic data key sent by the first device.

[0188] The decrypting module 22 is configured to decrypt the real-time dynamic data key, determine a public key and a private salt, verify the private salt according to the real-time dynamic service attribute corresponding to the second device, and decrypt the encrypted real-time dynamic data by using the public key to determine the real-time dynamic data if the verification is passed.

[0189] In some embodiments, the data decryption apparatus 2 further comprises a combining module, and the decrypting module 22 is further configured to decrypt the encrypted real-time dynamic data by using the public key to determine a plurality of system messages corresponding to the first teletext type, wherein each of the plurality of system messages comprises a data segment and a type mark, and the type mark is used to identify a first teletext sub-type of the data segment.

[0190] The combining module is configured to combine data segments of the same type mark to determine data of the at least one first teletext type

[0191] It should be noted that the above description of the apparatus embodiments is similar to the description of the above method embodiments, and has similar beneficial effects to the method embodiments. For technical details not disclosed in the apparatus embodiments of the present application, please refer to the description of the data decryption method embodiments of the present application for understanding.

[0192] The present application also provides a first device, Figure 9 An optional structure diagram of the first device provided by the present application is shown in the figure. Figure 9 As shown in the figure, the first device 3 comprises a first memory 32 and a first processor 33. The first memory 32 and the first processor 33 are connected through a first communication bus 34. The first memory 32 is configured to store executable instructions. The first processor 33 is configured to execute the executable instructions stored in the first memory 32 to implement the data encryption method provided by the present application.

[0193] The present application also provides a second device, Figure 10 An optional structure diagram of the second device provided by the present application is shown in the figure. Figure 10 As shown in the figure, the second device 4 comprises a second memory 42 and a second processor 43. The second memory 42 and the second processor 43 are connected through a second communication bus 44. The second memory 42 is configured to store executable instructions. The second processor 43 is configured to execute the executable instructions stored in the second memory 42 to implement the data decryption method provided by the present application.

[0194] The embodiment of the present application provides a computer readable storage medium storing executable instructions, wherein the executable instructions, when executed by the first processor, cause the first processor to execute the data encryption method provided by the embodiment of the present application; or the executable instructions, when executed by the second processor, cause the second processor to execute the data decryption method provided by the embodiment of the present application.

[0195] In some embodiments, the computer readable storage medium can be a Ferroelectric Random Access Memory (FRAM), a Read-Only Memory (ROM), a Programmable Read-Only Memory (PROM), an Erasable Programmable Read-Only Memory (EPROM), an Electrically Erasable Programmable Read-Only Memory (EEPROM), a flash memory, a magnetic surface memory, an optical disc, or a CD-ROM, and the like. The computer readable storage medium can also be various devices including one or any combination of the above storage devices.

[0196] In some embodiments, the executable instructions can be in the form of programs, software, software modules, scripts or codes, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and can be deployed in any form, including being deployed as standalone programs or being deployed as modules, components, subroutines or other units suitable for use in a computing environment.

[0197] As an example, the executable instructions can correspond to, but not necessarily, files in a file system, can be stored in a part of a file that stores other programs or data, for example, stored in one or more scripts in a Hyper Text Markup Language (HTML) document, stored in a single file dedicated to the program in question, or stored in multiple cooperative files (for example, files storing one or more modules, subroutines or code portions). As an example, the executable instructions can be deployed to execute on one computing device, or on multiple computing devices located in one place, or on multiple computing devices distributed in multiple places and interconnected through a communication network.

[0198] Those skilled in the art will appreciate that embodiments of the application can be devised for a variety of applications. It is therefore intended that the disclosure of embodiments of the application be considered in a descriptive sense only and not for purposes of limiting the scope of the present application. Accordingly, while the application is susceptible to various modifications and alternative forms, specific embodiments thereof have been shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that there is no intent to limit the application to the particular methods disclosed, but on the contrary, the disclosure is intended to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the application as defined by the appended claims.

[0199] The present application is described in reference to the drawings, which are as follows: Figure 1 Figure 1

[0200] Figure 1 Figure 1

[0201] Figure 1 Figure 1

[0202] The foregoing is considered as illustrative only of the principles of the application. Further, since numerous modifications and changes will readily occur to those skilled in the art, it is not desired to limit the application to the exact construction and practice described. Accordingly, all such variations are intended to be included within the scope of present application as defined in the following claims.​​​​​​​​

Claims

1. A data encryption method, characterized in that, Applied to a first device, the first device being used to provide real-time dynamic data to at least one second device, the method includes: Based on the real-time dynamic service attributes corresponding to the second device, a private salt corresponding to the second device is generated; the real-time dynamic service attributes include at least one of the real-time dynamic data length, broadcast delay, and broadcast frequency configured by the second device; The public key corresponding to the real-time dynamic data is encapsulated using the private salt to generate a real-time dynamic data key corresponding to the second device; the public key is used to encrypt the real-time dynamic data to obtain encrypted real-time dynamic data; the real-time dynamic data key is used by the second device to decrypt the public key and decrypt the encrypted real-time dynamic data using the public key.

2. The data encryption method according to claim 1, characterized in that, The step of generating a private salt corresponding to the second device based on the real-time dynamic service attributes of the second device includes: Based on the first preset correspondence between the real-time dynamic data length range and the first salt value, the target first salt value corresponding to the real-time dynamic data length configured in the second device is determined; And / or, Based on the second preset correspondence between the broadcast delay range and the second salt value, the target second salt value corresponding to the broadcast delay configured for the second device is determined; And / or, Based on the third preset correspondence between the broadcast frequency range and the third salt value, the target third salt value corresponding to the broadcast frequency configured for the second device is determined; The private salt is generated based on at least one of the target first salt value, the target second salt value, and the target third salt value.

3. The data encryption method according to claim 2, characterized in that, The first preset correspondence includes: a correspondence between at least one preset real-time dynamic data length range and at least one first preset salt value; The second preset correspondence includes: a correspondence between at least one preset broadcast delay range and at least one second preset salt value; The third preset correspondence includes: a correspondence between at least one preset broadcast frequency range and at least one third preset salt value.

4. The data encryption method according to any one of claims 1 to 3, characterized in that, The method further includes: Generate the initial public key; The public key is generated by salting the initial public key.

5. The data encryption method according to claim 4, characterized in that, The step of generating the public key by salting the initial public key includes: Generate a public salt based on the random string and the broadcast service identifier; Using the public salt, the initial public key is salted to generate the public key.

6. The data encryption method according to claim 5, characterized in that, The step of generating the public key by salting the initial public key using the public salt includes: Using the public salt, the initial public key is determined by performing a salting operation on the initial public key; The initial public key is incrementally processed to determine the initial incremental public key; The initial incremental public key is XORed and the remainder is taken to determine the public key.

7. The data encryption method according to claim 4, characterized in that, The step of encapsulating the public key corresponding to the real-time dynamic data using the private salt to generate the real-time dynamic data key corresponding to the second device includes: Add the device identifier corresponding to the second device to the header of the public key to determine the first initial key; The private salt is added to the end of the first initial key to determine the second initial key; The second initial key is encrypted to generate the real-time dynamic data key corresponding to the second device.

8. The data encryption method according to any one of claims 1 to 3, characterized in that, The method further includes: The real-time dynamic data is encrypted using the public key to determine the encrypted real-time dynamic data; The encrypted real-time dynamic data, along with the real-time dynamic data key corresponding to the second device, is broadcast to the at least one second device.

9. The data encryption method according to claim 1, characterized in that, The real-time dynamic data includes at least: data of at least one first message type; the method further includes: Based on the preset number of system messages in the broadcast cycle, the data of the at least one first message type is segmented to determine multiple data segments; Based on at least one first message subtype included in the first message type, determine multiple type tags corresponding to the multiple data segments; By combining the multiple data segments and the multiple type tags, multiple system messages are determined; The public key is used to encrypt the multiple system messages to determine the encrypted real-time dynamic data.

10. The data encryption method according to claim 9, characterized in that, The real-time dynamic data further includes: data of at least one second message type; the preset number of system messages based on the broadcast period, segmenting the data of the at least one first message type to determine multiple data segments, including: The remaining number of system messages is determined based on the preset number of system messages and the number of system messages occupied by the data of the at least one second message type; Based on the number of remaining system messages, the data of at least one first message type is segmented to determine the multiple data segments.

11. The data encryption method according to claim 10, characterized in that, The step of segmenting the data of at least one first message type based on the number of remaining system messages, and determining the plurality of data segments, includes: The data message header corresponding to the data of at least one first message type is determined as a data segment, and the remaining system message count is updated; the data segment corresponding to the data message header occupies one system message; If the number of remaining system messages is greater than a preset message number threshold, the data message body corresponding to the data of the at least one first message type is segmented according to the first preset segment length or the second preset segment length to determine at least one data segment. When the number of remaining system messages is equal to the preset message number threshold, and the number of data of the at least one first message type is less than or equal to the preset message number threshold, the data message body corresponding to the data of the at least one first message type is segmented according to the first preset segment length or the second preset segment length to determine at least one data segment; When the number of remaining system messages is equal to the preset message number threshold, and the number of data of at least one first message type is greater than the preset message number threshold, the data message body corresponding to the data of at least one first message type is segmented according to the first preset segment length to determine at least one data segment; the first preset segment length is less than the second preset segment length. The plurality of data segments are determined based on the data segment corresponding to the data message header and at least one data segment corresponding to the data message body.

12. The data encryption method according to claim 11, characterized in that, The step of determining multiple type tags corresponding to the multiple data segments based on at least one first message subtype included in the first message type includes: The type markers of the data segments corresponding to the data message header and data message body of the same first message subtype are determined as the preset type markers corresponding to the first message subtype, thereby determining the multiple type markers corresponding to the multiple data segments.

13. The data encryption method according to any one of claims 9 to 12, characterized in that, The first message type represents a message type that supports data segmentation, and the first message type includes at least: multi-signal message type; the second message type represents a message type that does not support data segmentation, and the second message type includes at least: antenna message type.

14. The data encryption method according to any one of claims 1 to 3, characterized in that, The first device includes: a server or a base station.

15. A data decryption method, characterized in that, Applied to a second device, the second device including any one of at least one second device connected to the first device; The first device is used to provide real-time dynamic data to the at least one second device; the method includes: Receive encrypted real-time dynamic data and real-time dynamic data key sent by the first device; Decrypt the real-time dynamic data key to determine the public key and private salt; Based on the real-time dynamic service attributes corresponding to the second device, a private salt corresponding to itself is generated. The private salt corresponding to itself is compared with the private salt decrypted from the real-time dynamic data key. If the comparison is consistent, the encrypted real-time dynamic data is decrypted using the public key to determine the real-time dynamic data. The real-time dynamic service attributes include at least one of the following: the real-time dynamic data length, broadcast delay, and broadcast frequency configured by the second device.

16. The data decryption method according to claim 15, characterized in that, The encrypted real-time dynamic data includes: multiple encrypted system messages; the real-time dynamic data includes at least: data of at least one first message type; the step of decrypting the encrypted real-time dynamic data using the public key to determine the real-time dynamic data includes: Using the public key, the encrypted real-time dynamic data is decrypted to determine multiple system messages corresponding to the first message type; each of the multiple system messages includes a data segment and a type tag; the type tag is used to identify the first message subtype of the data segment; The at least one first message type of data is determined by combining data segments marked with the same type.

17. The data decryption method according to claim 15 or claim 16, characterized in that, The second device includes: a terminal.

18. A data encryption device, characterized in that, The data encryption device is applied to a first device, which provides real-time dynamic data to at least one second device, and includes: The generation module is used to generate a private salt corresponding to the second device based on the real-time dynamic service attributes corresponding to the second device; the real-time dynamic service attributes include at least one of the real-time dynamic data length, broadcast delay, and broadcast frequency configured by the second device; The encapsulation module is used to encapsulate the public key corresponding to the real-time dynamic data using the private salt to generate a real-time dynamic data key corresponding to the second device; the public key is used to encrypt the real-time dynamic data to obtain encrypted real-time dynamic data; the real-time dynamic data key is used by the second device to decrypt the public key and decrypt the encrypted real-time dynamic data using the public key.

19. A data decryption device, characterized in that, Applied to a second device, the second device including any one of at least one second device connected to the first device; The first device is used to provide real-time dynamic data to the at least one second device; The data decryption device includes: The receiving module is used to receive encrypted real-time dynamic data and real-time dynamic data key sent by the first device; The decryption module is used to decrypt the real-time dynamic data key and determine the public key and private salt; based on the real-time dynamic service attributes corresponding to the second device, it generates its own corresponding private salt, compares its own private salt with the private salt decrypted from the real-time dynamic data key, and if the comparison is consistent, uses the public key to decrypt the encrypted real-time dynamic data to determine the real-time dynamic data; the real-time dynamic service attributes include at least one of the following: real-time dynamic data length, broadcast delay, and broadcast frequency configured by the second device.

20. A first device, characterized in that, include: A first memory and a first processor; wherein... The first memory is used to store executable instructions; The first processor, when executing executable instructions stored in the first memory, implements the data encryption method according to any one of claims 1 to 14.

21. A second device, characterized in that, include: A second memory and a second processor; wherein... The second memory is used to store executable instructions; The second processor, when executing executable instructions stored in the second memory, implements the data decryption method according to any one of claims 15 to 17.

22. A computer-readable storage medium, characterized in that, The device stores executable instructions that, when executed by a first processor, implement the data encryption method of any one of claims 1 to 14, or, when executed by a second processor, implement the data decryption method of any one of claims 15 to 17.

23. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by the first processor, they implement the steps of the data encryption method according to any one of claims 1 to 14; or, when the computer program or instructions are executed by the second processor, they implement the steps of the data decryption method according to any one of claims 15 to 17.

Images