Data transmission method and apparatus

Abstract

This disclosure proposes a data transmission method and apparatus. The method includes: acquiring data to be transmitted and data declaration information including a defined data transmission format and a cryptographic algorithm; encrypting the data to be transmitted based on the cryptographic algorithm to obtain encrypted data information; signing the data declaration information and the encrypted data information based on the cryptographic algorithm to obtain data signature information; encapsulating the data declaration information, the encrypted data information, and the signature information according to the data transmission format to obtain target data; and sending the target data to a data receiver. This disclosure improves the confidentiality of data during transmission by encrypting the data to be transmitted using a cryptographic algorithm; ensures the integrity and authenticity of the data by signing the data declaration information and the encrypted data information based on the cryptographic algorithm; and reduces transmission errors or parsing failures caused by inconsistent formats by encapsulating the data according to the data transmission format.

Description

Technical Field

[0001] This disclosure relates to the fields of data transmission and data security technology, and in particular to a data transmission method and apparatus. Background Technology

[0002] With the rapid development of information technology, data has become an indispensable core resource in modern society. However, data faces serious security threats during transmission, such as data leakage, unauthorized access, and tampering. These security issues can not only expose personal privacy but also cause significant losses to enterprises. Therefore, data encryption technology, as an important means of protecting data security, presents a pressing technical problem that needs to be solved: how to ensure data security during transmission through data encryption technology. Summary of the Invention

[0003] This disclosure provides a data transmission method and apparatus to at least partially solve one of the technical problems in the related art. The technical solution of this disclosure is as follows:

[0004] According to a first aspect of the present disclosure, a data transmission method is provided, applied to a data sender, comprising: acquiring data to be transmitted and data declaration information of the data to be transmitted, the data declaration information including a set data transmission format and a cryptographic algorithm; encrypting the data to be transmitted based on the cryptographic algorithm to obtain data encryption information; signing the data declaration information and the data encryption information based on the cryptographic algorithm to obtain data signature information; encapsulating the data declaration information, the data encryption information, and the data signature information according to the data transmission format to obtain target data; and sending the target data to a data receiver.

[0005] According to a second aspect of the present disclosure, a data transmission method is provided, applied to a data receiver, comprising: receiving target data from a data sender; decapsulating the target data to obtain data declaration information, data encryption information, and data signature information of data to be transmitted; wherein the data declaration information includes the data transmission format and a cryptographic algorithm, the data encryption information is obtained by encrypting the data to be transmitted based on the cryptographic algorithm, and the data signature information is obtained by signing the data declaration information and the data encryption information based on the cryptographic algorithm; performing signature verification based on the cryptographic algorithm and the data signature information; and, if the signature verification is successful, decrypting the data encryption information based on the cryptographic algorithm to obtain the data to be transmitted.

[0006] As one possible implementation of this disclosure, the encrypted data information includes a business request subject and ciphertext information. The step of decrypting the encrypted data information based on the cryptographic algorithm to obtain the data to be transmitted includes: obtaining the private key of the data recipient, and decrypting the ciphertext information based on the private key of the data recipient and the cryptographic algorithm to obtain plaintext information; if the data to be transmitted is business request data, determining the data to be transmitted based on the business request subject and the plaintext information; if the data to be transmitted is business response data of the business request data, determining the data to be transmitted based on the plaintext information.

[0007] As one possible implementation of this disclosure, the data encryption information further includes data verification information. Before obtaining the private key of the data recipient, the method further includes: performing validity verification on the target data based on the data verification information to obtain a validity verification result, so as to obtain the private key of the data recipient when the validity verification result indicates that the target data has passed the validity verification.

[0008] As one possible implementation of this disclosure, the data verification information includes a request data identifier and / or a data acquisition time. The step of validating the target data based on the data verification information to obtain a validity verification result includes: querying the historical data identifiers within a set historical time period based on the request data identifier to obtain an identifier query result; detecting whether the data acquisition time meets a set time requirement to obtain a time detection result; and determining the validity verification result based on the identifier query result and / or the time detection result.

[0009] As one possible implementation of this disclosure, the signature verification based on the cryptographic algorithm and the data signature information includes: obtaining target encoded data, the target encoded data including first encoded data and second encoded data connected by a set data connector, the first encoded data being obtained by encoding the data declaration information based on a set encoding algorithm, and the second encoded data being obtained by encoding the data encryption information based on a set encoding algorithm; obtaining the public key of the data sender, and signing the target encoded data based on the public key of the data sender and the cryptographic algorithm to obtain signature information to be verified; and performing signature verification based on the signature information to be verified and the data signature information.

[0010] As one possible implementation of this disclosure, the data declaration information includes a data source identifier. In the case that the data to be transmitted is service request data, the data source identifier is assigned by the data receiver to the data sender. Obtaining the public key of the data sender includes: in the case that the data to be transmitted is service request data, querying the public key of the data sender that matches the data source identifier from the public key library.

[0011] As one possible implementation of this disclosure, the target data includes target encoded data connected by the data connector and the data signature information. The step of decrypting the data encryption information based on the cryptographic algorithm to obtain the data to be transmitted includes: decoding the target encoded data based on a set encoding algorithm to obtain the data declaration information and the data encryption information; and decrypting the data encryption information based on the cryptographic algorithm included in the data declaration information to obtain the data to be transmitted.

[0012] As one possible implementation of this disclosure, the data declaration information includes a data source identifier. If the signature verification is successful, the method further includes: obtaining the data source identifier included in the data declaration information; and verifying, based on the data source identifier, whether the data recipient is the correct recipient of the target data.

[0013] According to a third aspect of the present disclosure, a data transmission apparatus is provided, applied to a data sender, comprising: an acquisition module, configured to acquire data to be transmitted and data declaration information of the data to be transmitted, the data declaration information including a set data transmission format and a cryptographic algorithm; an encryption module, configured to encrypt the data to be transmitted based on the cryptographic algorithm to obtain encrypted data information; a signature module, configured to sign the data declaration information and the encrypted data information based on the cryptographic algorithm to obtain data signature information; a processing module, configured to encapsulate the data declaration information, the encrypted data information, and the signature information according to the data transmission format to obtain target data; and a sending module, configured to send the target data to a data receiver.

[0014] According to a fourth aspect of the present disclosure, a data transmission apparatus is provided, applied to a data receiver, comprising: a receiving module for receiving target data from a data sender; a processing module for decapsulating the target data to obtain data declaration information, data encryption information, and data signature information of data to be transmitted; wherein the data declaration information includes the data transmission format and a cryptographic algorithm, the data encryption information is obtained by encrypting the data to be transmitted based on the cryptographic algorithm, and the data signature information is obtained by signing the data declaration information and the data encryption information based on the cryptographic algorithm; a signature verification module for performing signature verification based on the cryptographic algorithm and the data signature information; and a decryption module for decrypting the data encryption information based on the cryptographic algorithm, if the signature verification is successful, to obtain the data to be transmitted.

[0015] According to a fifth aspect of the present disclosure, an electronic device is provided, comprising: a processor and a memory communicatively connected to the processor; the memory storing computer-executable instructions; and the processor executing the computer-executable instructions stored in the memory to implement a data transmission method as described in the first aspect or the second aspect of the present disclosure.

[0016] According to a sixth aspect of the present disclosure, a computer-readable storage medium is provided, which stores computer-executable instructions that, when executed by a processor, are used to implement a data transmission method as described in the first aspect or the second aspect of the present disclosure.

[0017] According to a seventh aspect of the present disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements a data transmission method as described in the first aspect or the second aspect of the present disclosure.

[0018] The technical solution provided by the embodiments of this disclosure brings at least the following beneficial effects: It obtains the data to be transmitted and the data declaration information of the data to be transmitted, the data declaration information including the set data transmission format and cryptographic algorithm; it encrypts the data to be transmitted based on the cryptographic algorithm to obtain encrypted data information; it signs the data declaration information and the encrypted data information based on the cryptographic algorithm to obtain data signature information; it encapsulates the data declaration information, the encrypted data information, and the signature information according to the data transmission format to obtain target data; and it sends the target data to the data receiver. Based on this, encrypting the data to be transmitted using a cryptographic algorithm improves the confidentiality of the data during transmission, effectively resisting the risk of data leakage and theft; signing the data declaration information and the encrypted data information based on the cryptographic algorithm ensures the integrity of the data and the authenticity of its source; furthermore, encapsulation according to the data transmission format ensures that the data sender and data receiver have consistent understanding and processing of the data structure, reducing transmission errors or parsing failures caused by inconsistent formats, thereby improving the efficiency and reliability of data transmission. Furthermore, when the data to be transmitted is business request data, the business request parameters are encrypted to obtain ciphertext information; when the data to be transmitted is business response data of business request data, the business response data is encrypted to obtain ciphertext information. This reduces the amount of computation in the encryption process without leaking critical information, and thus also reduces the amount of computation for the data receiver when decrypting.

[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0020] The above and / or additional aspects and advantages of this disclosure will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, in which:

[0021] Figure 1 This is a schematic flowchart illustrating a data transmission method provided in the first embodiment of this disclosure;

[0022] Figure 2 This is a schematic flowchart illustrating a data transmission method provided in the second embodiment of this disclosure;

[0023] Figure 3 This is a schematic flowchart illustrating a data transmission method provided in the third embodiment of this disclosure;

[0024] Figure 4 This is a schematic flowchart illustrating a data transmission method provided in the fourth embodiment of this disclosure;

[0025] Figure 5 This is a schematic flowchart illustrating a data transmission method provided in the fifth embodiment of this disclosure;

[0026] Figure 6 This is a schematic flowchart of a data transmission method provided in the sixth embodiment of this disclosure;

[0027] Figure 7 This is a schematic flowchart illustrating a data transmission method provided in the seventh embodiment of this disclosure;

[0028] Figure 8 This is a schematic diagram of a data transmission interaction process provided in the eighth embodiment of this disclosure;

[0029] Figure 9 A schematic diagram of a data transmission device provided in the ninth embodiment of this disclosure;

[0030] Figure 10 This is a schematic diagram of the structure of a data transmission device provided in the tenth embodiment of the present disclosure;

[0031] Figure 11 This is a block diagram of the electronic device provided in the eleventh embodiment of this disclosure. Detailed Implementation

[0032] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0033] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0034] It should be noted that the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in the technical solution disclosed herein are all carried out with the consent of the user, and all comply with the provisions of relevant laws and regulations, and do not violate public order and good morals.

[0035] The data transmission method and apparatus of embodiments of this disclosure are described below with reference to the accompanying drawings.

[0036] Figure 1 This is a flowchart illustrating a data transmission method provided in the first embodiment of the present disclosure, wherein the method is applied to the data sender.

[0037] like Figure 1 As shown, the data transmission method includes the following steps:

[0038] Step 101: Obtain the data to be transmitted and its data declaration information, which includes the set data transmission format and cryptographic algorithm.

[0039] The data to be transmitted refers to the data transmitted from the data sender to the data receiver. The data declaration information of the data to be transmitted is used to declare the transmission format of the data to be transmitted and the cryptographic algorithm used.

[0040] As an example, the data to be transmitted includes images, files, business request data, and business response data. The data transmission format is set to JSON Web Tokens (JWT), and the cryptographic algorithm is an asymmetric cryptographic algorithm such as the SM2 cryptographic algorithm.

[0041] Step 102: Based on the cryptographic algorithm, encrypt the data to be transmitted to obtain encrypted data information.

[0042] To improve data security during transmission and prevent data leakage, as an example, the public key of the data recipient is obtained; based on the encryption process of the cryptographic algorithm and the public key of the data recipient, the data to be transmitted is encrypted to obtain encrypted data information.

[0043] Step 103: Based on the cryptographic algorithm, sign the data declaration information and the data encryption information to obtain the data signature information.

[0044] The private key of the data sender is usually kept by the data sender, so the risk of key leakage is relatively small. In order to improve the security and trustworthiness of data transmission, as an example, based on the private key of the data sender, and following the signature process of the cryptographic algorithm, the data declaration information and the data encryption information are signed based on the private key of the data sender to obtain the data signature information.

[0045] Step 104: According to the data transmission format, the data declaration information, data encryption information, and data signature information are encapsulated to obtain the target data.

[0046] In the case of JWT format, the encapsulation of data declaration information, data encryption information and data signature information according to the data transmission format means that the data declaration information is used as the header content of the JWT, the data encryption information is used as the payload content of the JWT, and the data signature information is used as the signature content of the JWT.

[0047] When using the JWT format for data transmission, cryptographic algorithms and digital signatures are used to encrypt and prevent tampering of the data to be transmitted, which improves the security and integrity of the data during transmission and can effectively prevent the data from being attacked or tampered with by a man-in-the-middle.

[0048] To enable the data receiver to efficiently and accurately decapsulate the target data, the data declaration information, data encryption information, and data signature information within the target data are precisely separated. As an example, based on a defined data connector, the data declaration information, data encryption information, and data signature information are joined to obtain the target data. These data connectors include, but are not limited to, ".", "*", and " / ".

[0049] Step 105: Send the target data to the data receiver.

[0050] In order to improve data transmission efficiency, the target data is sent to the data receiver by setting an interface.

[0051] In summary, the process involves obtaining the data to be transmitted and its data declaration information, which includes the defined data transmission format and cryptographic algorithm. Based on the cryptographic algorithm, the data to be transmitted is encrypted to obtain encrypted data information. Based on the cryptographic algorithm, the data declaration information and encrypted data information are signed to obtain data signature information. According to the data transmission format, the data declaration information, encrypted data information, and data signature information are encapsulated to obtain the target data. Finally, the target data is sent to the data receiver. Therefore, encrypting the data to be transmitted using a cryptographic algorithm improves the confidentiality of the data during transmission, effectively resisting the risk of data leakage and theft. Signing the data declaration information and encrypted data information based on the cryptographic algorithm ensures the integrity of the data and the authenticity of its source. Furthermore, encapsulation according to the data transmission format ensures that the data sender and receiver have consistent understanding and processing of the data structure, reducing transmission errors or parsing failures caused by format inconsistencies, thereby improving the efficiency and reliability of data transmission.

[0052] To clearly illustrate how the transmitted data is encrypted in the above embodiments, this disclosure proposes another data transmission method.

[0053] Figure 2 This is a schematic flowchart of a data transmission method provided in the second embodiment of this disclosure.

[0054] like Figure 2 As shown, the data transmission method may include the following steps:

[0055] Step 201: Obtain the data to be transmitted and its data declaration information.

[0056] Step 202: If the data to be transmitted is business request data, parse the business request data to extract the business request subject and business request parameters; obtain the public key of the data receiver, and encrypt the business request parameters based on the public key of the data receiver and the cryptographic algorithm to obtain ciphertext information.

[0057] Among them, business request data refers to data initiated by the data sender during business processing, requesting the data receiver to return business response data; business request data consists of business request subject and business request parameters. The business request subject refers to the purpose and intent of the business request, and the business request parameters are elements in the business request data that specifically describe the request content and conditions.

[0058] As an example, a large-scale model can be used to parse business request data to extract the business request topic and business request parameters.

[0059] As an example rather than a limitation, suppose the business request data is "Query user A's leave records in the past month", then the business request subject is "Query leave records", and the business request parameters are "user A" and "past month".

[0060] Encrypting the entire business request data requires a significant amount of computation, and the leakage of the business request subject will not lead to the leakage of critical information. Based on this, in order to reduce the amount of computation in the encryption process, as an example, the business request parameters are encrypted based on the data recipient's public key and cryptographic algorithm to obtain ciphertext information.

[0061] Step 203: If the data to be transmitted is business response data of business request data, obtain the business request topic corresponding to the business request data; obtain the public key of the data receiver, and encrypt the business response data based on the public key of the data receiver and the cryptographic algorithm to obtain ciphertext information.

[0062] It should be noted that there is target data corresponding to the business request data. When the data to be transmitted is the business response data of the business request data, the business request topic corresponding to the business request data is obtained from the target data corresponding to the business request data.

[0063] To reduce the computational load during the encryption process, as another example, the business response data is encrypted based on the data recipient's public key and cryptographic algorithm to obtain ciphertext information.

[0064] It should be noted that the data sender and data receiver are relative concepts; a device or system can be both a data sender and a data receiver.

[0065] The following uses the example of the application provider and the system provider that provides services to the application provider to illustrate the roles of data sender and data receiver: When the application provider sends business request data to the system provider, the application provider is the data sender and the system provider is the data receiver; when the system provider responds to the business request data and sends business response data to the application provider, the system provider is the data sender and the application provider is the data receiver.

[0066] Step 204: Generate data encryption information based on the business request subject and encrypted information.

[0067] To enable data recipients to decrypt data more quickly, as an example, the business request subject and encrypted information are arranged according to a set order to obtain encrypted data information.

[0068] Step 205: Based on the cryptographic algorithm, sign the data declaration information and the data encryption information to obtain the data signature information.

[0069] Step 206: According to the data transmission format, the data declaration information, data encryption information, and data signature information are encapsulated to obtain the target data.

[0070] Step 207: Send the target data to the data receiver.

[0071] It should be noted that the execution process of steps 201 and 205-207 can be implemented in any of the embodiments of this disclosure. This disclosure does not limit this and will not elaborate further.

[0072] In summary, when the data to be transmitted is business request data, the business request data is parsed to extract the business request subject and parameters; the public key of the data receiver is obtained, and the business request parameters are encrypted using the data receiver's public key and cryptographic algorithm to obtain ciphertext information. When the data to be transmitted is business response data corresponding to the business request data, the business request subject corresponding to the business request data is obtained; the public key of the data receiver is obtained, and the business response data is encrypted using the data receiver's public key and cryptographic algorithm to obtain ciphertext information; and encrypted data information is generated based on the business request subject and ciphertext information. Therefore, encrypting business request parameters or business response data to obtain ciphertext information can reduce the computational load during encryption without leaking critical information, thereby reducing the computational load for the data receiver during decryption.

[0073] To clearly illustrate how data encryption information is generated based on the business request subject and ciphertext information in the above embodiments, this disclosure proposes another data transmission method.

[0074] Figure 3 This is a schematic flowchart of a data transmission method provided in the third embodiment of this disclosure.

[0075] like Figure 3 As shown, the data transmission method may include the following steps:

[0076] Step 301: Obtain the data to be transmitted and its data declaration information.

[0077] Step 302: If the data to be transmitted is business request data, parse the business request data to extract the business request subject and business request parameters; obtain the public key of the data receiver, and encrypt the business request parameters based on the public key of the data receiver and the cryptographic algorithm to obtain ciphertext information.

[0078] Step 303: If the data to be transmitted is business response data of business request data, obtain the business request topic corresponding to the business request data; obtain the public key of the data receiver, and encrypt the business response data based on the public key of the data receiver and the cryptographic algorithm to obtain ciphertext information.

[0079] Step 304: Obtain data verification information. The data verification information is used to enable the data recipient to verify the validity of the target data.

[0080] Among them, data verification information refers to the verification information agreed upon by the data sender and the data receiver, or information obtained through a specific algorithm to verify the validity of the data.

[0081] It should be noted that when performing validity verification based on data verification information, the determination of whether the target data is valid depends on whether data verification information is included or whether the included data verification information is correct.

[0082] As an example, when the data to be transmitted is business request data, a request data identifier corresponding to the business request data is generated according to the set identifier generation rules; the data acquisition time is determined based on the time when the business request data is acquired, and / or the time when the encrypted information of the business request parameters is acquired; when the data to be transmitted is business response data of the business request data, the request data identifier corresponding to the business request data is acquired; the data acquisition time is determined based on the time when the business response data is acquired, and / or the time when the encrypted information of the business response data is acquired; and data verification information is determined based on the request data identifier and / or the data acquisition time.

[0083] It's important to understand that the request data identifier is a unique identifier for the business requesting data. The data retrieval time indicates when the data was generated.

[0084] As one possible implementation, the data acquisition time is determined based on the time when the business request data is acquired, and / or the time when the encrypted information of the business request parameters is acquired. This includes: selecting the time when the business request data is acquired or the time when the encrypted information of the business request parameters is acquired as the data acquisition time; or, determining a time interval based on the time when the business request data is acquired, and / or the time when the encrypted information of the business request parameters is acquired, and selecting a time within the determined time interval to obtain the data acquisition time.

[0085] Step 305: Generate data encryption information based on the business request subject, encrypted information, and data verification information.

[0086] To enable data recipients to decrypt data more quickly, as an example, the business request subject, encrypted information, and data verification information are arranged according to a set order to obtain encrypted data information.

[0087] Adding data verification information to the data encryption information allows the data recipient to determine whether the target data is valid before decryption, thereby avoiding the waste of computing resources.

[0088] Step 306: Based on the cryptographic algorithm, sign the data declaration information and the data encryption information to obtain the data signature information.

[0089] Step 307: According to the data transmission format, the data declaration information, data encryption information, and data signature information are encapsulated to obtain the target data.

[0090] Step 308: Send the target data to the data receiver.

[0091] It should be noted that the execution process of steps 301 and 306-308 can be implemented in any of the embodiments of this disclosure. This disclosure does not limit this and will not elaborate further.

[0092] In summary, data verification information is obtained and used by the data recipient to verify the validity of the target data. Based on the business request subject, encrypted information, and data verification information, encrypted data information is generated. Therefore, adding data verification information to the encrypted data information allows the data recipient to determine the validity of the target data before decryption, thus avoiding waste of computing resources.

[0093] To clearly illustrate how the data declaration information of the data to be transmitted is obtained and how the data declaration information and data encryption information are signed in the above embodiments, this disclosure proposes another data transmission method.

[0094] Figure 4 This is a schematic flowchart of a data transmission method provided in the fourth embodiment of this disclosure.

[0095] like Figure 4 As shown, the data transmission method may include the following steps:

[0096] Step 401: Obtain the data to be transmitted.

[0097] Step 402: If the data to be transmitted is business request data, obtain the data source identifier assigned by the data receiver to the data sender; generate data declaration information based on the data transmission format, cryptographic algorithm and data source identifier.

[0098] The data source identifier is used to verify whether the data recipient is the correct recipient of the target data corresponding to the business response data.

[0099] When the data to be transmitted is a business request data, the data sender may not have the authority to request data from the data receiver. If the data sender does not have the authority to request data from the data receiver, then the data receiver is not the correct recipient of the target data.

[0100] The data receiver stores the data source identifier of the data issuer with which it has access rights. After receiving the target data, the data receiver can match the data source identifier included in the target data with the stored data source identifier. If the data source identifier included in the target data is the same as any of the stored data source identifiers, then the data receiver is the correct recipient of the target data.

[0101] To ensure that each data sender has a unique data source identifier, enabling the data receiver to quickly and accurately determine whether it is the correct recipient of the target data, as an example, when the data to be transmitted is business request data, a source identifier retrieval request is sent to the data receiver, and the data receiver, in response to the source identifier retrieval request, assigns a data source identifier to the data sender. Notably, if the data sender does not have the authority to request data from the data receiver, the data sender will not assign a data source identifier to the data sender.

[0102] To enable data recipients to quickly ascertain the cryptographic algorithm and the source of the target data, thereby improving data decryption efficiency, as an example, the data transmission format, cryptographic algorithm, and data source identifier are arranged according to a predetermined order to obtain data declaration information.

[0103] Step 403: If the data to be transmitted is the business response data of the business request data, obtain the data declaration information from the target data corresponding to the business request data.

[0104] If the data to be transmitted is the business response data of the business request data, then the data sender must have received the target data corresponding to the business request data beforehand. Based on this, in order to improve the efficiency of target data generation and the efficiency of the data receiver in determining whether it is the correct recipient of the target data, as an example, the data declaration information is directly obtained from the target data corresponding to the business request data, and the obtained data declaration information is used as the data declaration information in the target data corresponding to the business response data.

[0105] It should be noted that the data source identifier included in the data declaration information is the same as the data source identifier included in the target data corresponding to the business request data. It is used to verify whether the data recipient is the correct recipient of the target data corresponding to the business response data.

[0106] When the data to be transmitted is a business response to a business request, the data receiver matches the data source identifier included in the target data with its own identifier. If the data source identifier included in the target data is the same as its own identifier, then the target data is determined to be the response data to the business request, that is, the data receiver is the correct recipient of the target data.

[0107] Step 404: Based on the cryptographic algorithm, encrypt the data to be transmitted to obtain encrypted data information.

[0108] Step 405: Encode the data declaration information based on the set encoding algorithm to obtain the first encoded data, and encode the data encryption information based on the set encoding algorithm to obtain the second encoded data.

[0109] In this embodiment of the disclosure, the encoding algorithm is defined as an encoding algorithm that uses 64 printable characters to represent binary data (Base64); the first encoded data and the second encoded data obtained based on the Base64 encoding algorithm are strings.

[0110] As an example rather than a limitation, the first encoded data is represented as "YYYYY" and the second encoded data is represented as "YYYY".

[0111] Step 406: Using the set data connector, connect the first encoded data and the second encoded data to obtain the target encoded data.

[0112] Connecting the first and second encoded data using data connectors helps the data receiver quickly split the target encoded data, thereby improving data decryption efficiency.

[0113] As an example rather than a limitation, the target encoded data is represented as "YYYYY.YYYY".

[0114] Step 407: Obtain the private key of the data sender, and sign the target encoded data based on the private key and cryptographic algorithm to obtain data signature information.

[0115] It should be noted that the encoding algorithm limits the length and complexity of the encoded data. Therefore, signing the target encoded data helps to simplify the signing process.

[0116] As an example, and not a limitation, the data signature information is represented as "YYY".

[0117] Step 408: Obtain the target encoded data corresponding to the data declaration information and data encryption information; use a data connector to connect the target encoded data and the data signature information to obtain the target data.

[0118] Encoding is the process of converting binary data into a text string, which indirectly increases the security of data during transmission and reduces the risk of data being directly parsed or tampered with.

[0119] As an example, not a limitation, the target data is represented as "YYYYY.YYYY.YYY". It should be noted that the different numbers of Y's corresponding to the first encoded data, the second encoded data, and the data signature information are only used to distinguish between the different parts of the data and do not represent the specific data or data length.

[0120] Step 409: Send the target data to the data receiver.

[0121] It should be noted that the execution processes of steps 401, 404, 407, and 409 can be implemented in any of the embodiments of this disclosure. This disclosure does not limit these processes and will not elaborate further.

[0122] In summary, when the data to be transmitted is business request data, the data source identifier assigned by the data receiver to the data sender is obtained. Based on the data transmission format, cryptographic algorithm, and data source identifier, data declaration information is generated, ensuring the uniqueness of the data source identifier corresponding to each data sender. When the data to be transmitted is business response data corresponding to business request data, data declaration information is obtained from the target data corresponding to the business request data, improving the generation efficiency of the target data. Furthermore, the data declaration information is encoded using a set encoding algorithm to obtain first encoded data, and the data encryption information is encoded using the same algorithm to obtain second encoded data. A set data connector is used to connect the first and second encoded data to obtain target encoded data. Signing the target encoded data yields data signature information, reducing the computational load in the data signing process. Additionally, the target encoded data corresponding to the data declaration information and data encryption information is obtained; a data connector is used to connect the target encoded data and data signature information to obtain the target data, reducing data transmission volume and improving the transmission efficiency of the target data.

[0123] Figure 5 This is a flowchart illustrating a data transmission method provided in the fifth embodiment of this disclosure, wherein the method is applied to a data receiver.

[0124] like Figure 5 As shown, the data transmission method may include the following steps:

[0125] Step 501: Receive target data from the data sender.

[0126] Step 502: Decapsulate the target data to obtain data declaration information, data encryption information, and data signature information of the data to be transmitted; wherein, the data declaration information includes the data transmission format and cryptographic algorithm, the data encryption information is obtained by encrypting the data to be transmitted based on the cryptographic algorithm, and the data signature information is obtained by signing the data declaration information and the data encryption information based on the cryptographic algorithm.

[0127] To quickly and accurately obtain the data to be transmitted, as an example, the target data is split into data declaration information, data encryption information, and data signature information.

[0128] Step 503: Perform signature verification based on the cryptographic algorithm and data signature information.

[0129] To verify whether the data has been tampered with during transmission, as an example, based on a cryptographic algorithm, the data declaration information and data encryption information obtained in step 502 are signed to obtain the signature information to be verified; the signature information to be verified is compared with the data signature information obtained in step 502; if the signature information to be verified and the data signature information are the same, the signature verification passes; if the signature information to be verified and the data signature information are different, the signature verification fails.

[0130] Step 504: If the signature verification is successful, the encrypted data information is decrypted based on the cryptographic algorithm to obtain the data to be transmitted.

[0131] As an example, a decryption process based on cryptographic algorithms decrypts encrypted data to obtain the data to be transmitted.

[0132] It should be noted that the relevant content in steps 501 and 504 can be found in the description of any embodiment in the various embodiments of this disclosure. This disclosure does not limit the scope of the embodiments and will not repeat them hereafter.

[0133] In summary, the process involves receiving target data from the sender; decapsulating the target data to obtain data declaration information, data encryption information, and data signature information for the data to be transmitted. The data declaration information includes the data transmission format and cryptographic algorithm; the data encryption information is obtained by encrypting the data to be transmitted based on the cryptographic algorithm; and the data signature information is obtained by signing the data declaration information and the data encryption information based on the cryptographic algorithm. Signature verification is performed based on the cryptographic algorithm and the data signature information. If the signature verification is successful, the data encryption information is decrypted based on the cryptographic algorithm to obtain the data to be transmitted. Therefore, receiving target data according to the set data transmission format reduces transmission errors or parsing failures caused by format inconsistencies, thereby improving the efficiency and reliability of data transmission. Verifying the data signature information in the target data based on the cryptographic algorithm ensures the integrity and authenticity of the data source. After successful signature verification, the data encryption information in the target data is decrypted based on the cryptographic algorithm to obtain the data to be transmitted, ensuring the confidentiality of the data during transmission.

[0134] To clearly illustrate how the target data is validated in the above embodiments, this disclosure proposes another data transmission method.

[0135] Figure 6 This is a schematic flowchart of a data transmission method provided in the sixth embodiment of this disclosure.

[0136] like Figure 6 As shown, the data transmission method may include the following steps:

[0137] Step 601: Receive target data from the data sender.

[0138] Step 602: Decapsulate the target data to obtain the data declaration information, data encryption information, and data signature information of the data to be transmitted; wherein, the data declaration information includes the data source identifier, and the data encryption information includes the business request subject, ciphertext information, and data verification information.

[0139] The data source identifier is used to verify whether the data recipient is the correct recipient of the target data corresponding to the business response data. When the data to be transmitted is business request data, the encrypted information is obtained by encrypting the business request parameters based on the data recipient's public key and cryptographic algorithm; when the data to be transmitted is business response data of the business request data, the encrypted information is obtained by encrypting the business response data based on the data recipient's public key and cryptographic algorithm. The data verification information is used to enable the data recipient to verify the validity of the target data.

[0140] Step 603: Perform signature verification based on the cryptographic algorithm and data signature information.

[0141] Step 604: If the signature verification passes, perform validity verification on the target data based on the data verification information to obtain the validity verification result.

[0142] The data verification information includes a request data identifier and / or a data acquisition time. It should be noted that, when the data to be transmitted is a service request data, the request data identifier enables the data receiver to determine whether the service request data is a duplicate request, and the data acquisition time enables the data receiver to determine whether the service request data was sent within the allowed time. When the data to be transmitted is a service response data to a service request data, the request data identifier enables the data receiver to determine whether the target data sent by the data sender matches the service request data, and the data acquisition time enables the data receiver to determine whether the data sender returned the service response data within the set time.

[0143] To accurately verify the validity of target data, as an example, based on the requested data identifier, an identifier query is performed on historical data identifiers within a set historical time period to obtain the identifier query results; whether the data acquisition time meets the set time requirements is checked to obtain the time check results; and the validity verification result is determined based on the identifier query results and / or the time check results.

[0144] Specifically, whether the data acquisition time meets the set time requirement refers to whether the data acquisition time falls within a set time period. If the data acquisition time is within the set time period, then the data acquisition time meets the set time requirement; if the data acquisition time is outside the set time period, then the data acquisition time does not meet the set time requirement. The set time period refers to the allowed access period or a period determined based on a response time threshold.

[0145] As an example and not a limitation, when determining the validity verification result based on the identifier query result and the time detection result, if the identifier query result indicates that the requested data identifier was not found in the historical data identifiers within the set historical period, and the data acquisition time meets the set time requirement, then the validity verification result indicates that the target data has passed the validity verification; otherwise, the validity verification result indicates that the target data has not passed the validity verification.

[0146] Step 605: Obtain the data source identifier included in the data declaration information; based on the data source identifier, verify whether the data recipient is the correct recipient of the target data.

[0147] When the data to be transmitted is business request data, the data receiver stores the data source identifier of the data issuer with the access permission. After obtaining the data source identifier in the data declaration information, the data receiver matches the obtained data source identifier with the stored data source identifier. If the data source identifier included in the target data is the same as any of the stored data source identifiers, then the data receiver is the correct recipient of the target data.

[0148] When the data to be transmitted is the response data of the service request data, since the data declaration information is directly obtained from the target data corresponding to the service request data, the data receiver matches the data source identifier included in the data declaration information with its own identifier to determine whether the target data is the response data of the service request data. If the data source identifier included in the data declaration information is the same as its own identifier, then the target data is determined to be the response data of the service request data, that is, the data receiver is the correct receiver of the target data.

[0149] Step 606: If the validity verification result indicates that the target data has passed the validity verification and the data receiver is the correct recipient of the target data, obtain the private key of the data receiver, and decrypt the ciphertext information based on the private key of the data receiver and the cryptographic algorithm to obtain the plaintext information.

[0150] Based on the decryption process of the cryptographic algorithm and combined with the private key of the data recipient, the ciphertext information is decrypted to obtain the plaintext information.

[0151] Specifically, when the data to be transmitted is service request data, the plaintext information is the service request parameters; when the data to be transmitted is service response data of service request data, the plaintext information is the service response data.

[0152] Step 607: If the data to be transmitted is service request data, determine the data to be transmitted based on the service request subject and plaintext information; if the data to be transmitted is service response data of service request data, determine the data to be transmitted based on plaintext information.

[0153] When the data to be transmitted is business request data, the data receiver obtains the business response data based on the business request subject and plaintext information.

[0154] It should be noted that the execution process in steps 601 and 603 can be implemented in any of the embodiments of this disclosure. This disclosure does not limit this and will not elaborate further.

[0155] In summary, if signature verification passes, the data receiver's private key is obtained, and the target data is validated based on the data verification information to obtain a validity verification result. If the validity verification result indicates that the target data has passed the validity verification, the ciphertext information is decrypted based on the data receiver's private key and cryptographic algorithm to obtain the plaintext information. If the data to be transmitted is business request data, the data to be transmitted is determined based on the business request subject and plaintext information. If the data to be transmitted is business response data to the business request data, the data to be transmitted is determined based on the plaintext information. Therefore, the data receiver determines whether the target data is valid before decryption based on the data verification information, avoiding waste of computing resources.

[0156] To clearly illustrate how signature verification is performed based on cryptographic algorithms and data signature information in the above embodiments, this disclosure proposes another data transmission method.

[0157] Figure 7 This is a schematic flowchart of a data transmission method provided in the seventh embodiment of this disclosure.

[0158] like Figure 7 As shown, the data transmission method may include the following steps:

[0159] Step 701: Receive target data from the data sender. The target data includes target encoded data connected by a data connector and data signature information.

[0160] The target encoded data includes first encoded data and second encoded data connected by a set data connector. The first encoded data is obtained by encoding data declaration information based on a set encoding algorithm, and the second encoded data is obtained by encoding data encryption information based on a set encoding algorithm. The data signature information is obtained by signing the target encoded data based on the private key and cryptographic algorithm of the data sender. The data declaration information includes a data source identifier.

[0161] Step 702: Decapsulate the target data to obtain the target encoded data and data signature information.

[0162] It should be noted that since the data sender encodes the data declaration information and data encryption information before transmitting the data, the result after decapsulating the target data is the first encoded data, the second encoded data, and the data signature information.

[0163] Step 703: If the data to be transmitted is business request data, obtain the data source identifier in the target encoded data and query the public key of the data sender that matches the data source identifier from the public key library; if the data to be transmitted is business response data of business request data, query the public key of the data sender from the public key library.

[0164] Since the data source identifier is located in the first encoded data, in order to reduce the computational load of the decoding process, as an example, based on the set encoding algorithm, the first encoded data in the target encoded data is decoded to obtain the data source identifier included in the data declaration information.

[0165] The public key store is used to store the public keys of each data sender. When the data to be transmitted is a business response to a business request, the sender's identifier is obtained, and the sender's public key is retrieved from the public key store based on this identifier. To enable the data receiver to obtain the sender's public key, as an example, when the data to be transmitted is a business response to a business request, the sender's identifier is sent to the data receiver along with the target data.

[0166] Step 704: Based on the public key and cryptographic algorithm of the data sender, sign the target encoded data to obtain the signature information to be verified; based on the signature information to be verified and the data signature information, perform signature verification.

[0167] It should be noted that, in conjunction with the signature process of the cryptographic algorithm, the target encoded data is signed based on the public key of the data sender to obtain the signature information to be verified.

[0168] If the signature information to be verified is the same as the data signature information, the signature verification passes; if the signature information to be verified is different from the data signature information, the signature verification fails.

[0169] Step 705: If the signature verification is successful, decode the target encoded data based on the set encoding algorithm to obtain data declaration information and data encryption information; decrypt the data encryption information based on the cryptographic algorithm included in the data declaration information to obtain the data to be transmitted.

[0170] Since the target encoded data is encoded data, it is necessary to decode the target encoded data based on the set encoding algorithm before decryption to obtain the data declaration information and data encryption information.

[0171] It should be noted that the execution process in step 705 can be implemented in any of the embodiments of this disclosure. This disclosure does not limit this and will not elaborate further.

[0172] In summary, the received target data is decapsulated to obtain target encoded data and data signature information. If the data to be transmitted is a business request, the data source identifier in the target encoded data is obtained, and the public key of the data sender matching the data source identifier is retrieved from the public key repository. If the data to be transmitted is a business response to the business request, the public key of the data sender is retrieved from the public key repository. Based on the data sender's public key and cryptographic algorithm, the target encoded data is signed to obtain signature information to be verified. Signature verification is performed based on the signature information to be verified and the data signature information. If the signature verification passes, the target encoded data is decoded based on the set encoding algorithm to obtain data declaration information and data encryption information. Based on the cryptographic algorithm included in the data declaration information, the data encryption information is decrypted to obtain the data to be transmitted. The encoding algorithm limits the length and complexity of the encoded data, which simplifies the signature verification process and improves its efficiency.

[0173] Figure 8 This is a schematic diagram of a data transmission interaction process provided in the eighth embodiment of this disclosure. The data transmission interaction process will be described below using the application side and the system side as examples.

[0174] The application obtains a unique identifier (client ID), which is also the data source identifier, from the system and generates a key pair. The application configures its private key in its system parameters and sends its public key to the system. The system stores the public keys of each application in a public key library and associates the application with its public key through the client ID. The application's private key is used to sign and decrypt data sent to the system. The application's public key is used to enable the system to verify the signature of data sent from the application and to encrypt data sent to the application.

[0175] The system generates a key pair, configures the private key into the system parameters, and provides the public key information to the application. The application stores the system's public key. The system's private key is used to decrypt data transmitted from the application and to sign data sent to the application. The system's public key is used to enable the application to sign and verify data sent by the system and to encrypt data sent to the system.

[0176] like Figure 8 As shown, the data transmission interaction process includes:

[0177] Step 801: The application obtains the business request data and the data declaration information based on the data transmission format, cryptographic algorithm and the application's data source identifier.

[0178] The data declaration information is {type:"JWT", alg:"SM2", client Id:"XXX"}, where type indicates the set data transmission format, alg indicates the cryptographic algorithm, and client Id indicates the data source identifier of the application.

[0179] Step 802: Obtain the business request topic and business request parameters; encrypt the business request parameters based on the system's public key to obtain ciphertext information; generate data encryption information based on the business request topic, ciphertext information, and data verification information.

[0180] The data verification information includes the request data identifier and the data acquisition time of the business request data.

[0181] As an example, the data encryption information is {methodId:"XXXX", data:"XXXX", jti:"XXXXX", iat:"XXXXX"}, where methodId represents the business request subject of the business request data, data represents the encrypted information of the business request parameters, jti represents the request data identifier, and iat represents the data acquisition time.

[0182] Step 803: Sign the target encoded data corresponding to the data declaration information and data encryption information based on the application's private key to obtain data signature information.

[0183] The data declaration information is encoded using a set encoding algorithm to obtain the first encoded data "YYYYY". The data encryption information is encoded using the set encoding algorithm to obtain the second encoded data "YYYY". The first encoded data and the second encoded data are connected using a set data connector to obtain the target encoded data "YYYYY.YYYY". The target encoded data is signed based on the application's private key and cryptographic algorithm to obtain the data signature information "YYY".

[0184] Step 804: Use a data connector to connect the target encoded data and the data signature information to obtain the first target data.

[0185] As an example, the first target data is "YYYYY.YYYY.YYY".

[0186] Step 805: Send the first target data to the system.

[0187] Step 806: The system receives the first target data and performs decapsulation processing on the first target data.

[0188] Step 807: Obtain the application's public key and perform signature verification based on the application's public key.

[0189] Obtain the first encoded data from the target encoded data; decode the first encoded data based on the set encoding algorithm to obtain the client Id from the data declaration information; query the application's public key based on the client Id.

[0190] Signature verification based on the application's public key includes: signing the target encoded data based on the application's public key and cryptographic algorithm to obtain the signature information to be verified; and performing signature verification based on the signature information to be verified and the data signature information.

[0191] Step 808: Obtain data verification information, and verify the validity of the first target data based on the data verification information.

[0192] If the signature verification passes, the second encoded data in the target encoded data is obtained; the second encoded data is decoded based on the set encoding algorithm to obtain the jti and iat in the data encryption information, and the validity of the target data is verified based on the jti and iat.

[0193] Step 809: Obtain the data source identifier included in the data declaration information; based on the data source identifier, verify whether the system is the correct recipient of the first target data.

[0194] The system will match the data source identifier included in the data declaration information with the data source identifiers of each application party that has access permissions, determine whether the application party has the authority to request data from the system, and then determine whether the system is the correct recipient of the first target data.

[0195] Step 8010: If the validity verification is successful and the system is the correct recipient of the first target data, the encrypted information is decrypted based on the system's private key to obtain the business request parameters.

[0196] Step 8011: Based on the business request topic and business request parameters, obtain the business response data of the business request data.

[0197] Specifically, the methodId is obtained from the encrypted information of the decoded data, and then combined with the business request parameters to obtain the business response data.

[0198] Step 8012: Obtain the data declaration information and the data encryption information of the business response data from the first target data.

[0199] The business response data is encrypted using the application's public key to obtain the ciphertext information "ZZZZZ" of the business response data.

[0200] Obtain the methodId and jti from the encrypted information of the first target data; determine the iat of the business response data based on the time when the business response data was obtained, and / or the time when the encrypted information of the business response data was obtained.

[0201] As an example, the data encryption information is {methodId:"XXXX", data:"ZZZZ", jti:"XXXXX", iat:"ZZZZZ"}.

[0202] Step 8013: Based on the system's private key, sign the data declaration information and the data encryption information of the business response data to obtain the data signature information of the business response data.

[0203] The data declaration information and the data encryption information of the business response data are encoded based on the set encoding algorithm to obtain the target encoded data of the business response data; the new target encoded data is signed based on the system's private key and cryptographic algorithm to obtain the data signature information of the business response data.

[0204] Step 8014: Using a data connector, the target encoded data and data signature information of the business response data are connected to obtain the second target data.

[0205] In step 8015, the system returns the second target data to the application.

[0206] Step 8016: The application receives the second target data and decapsulates it to obtain the target encoded data and data signature information of the business response data.

[0207] Step 8017: Obtain the system's public key and perform signature verification based on the application's public key.

[0208] Step 8018: Obtain data verification information, and verify the validity of the second target data based on the data verification information.

[0209] Step 8019: Obtain the data source identifier included in the data declaration information; based on the data source identifier, verify whether the application is the correct recipient of the second target data.

[0210] The application will match the data source identifier included in the second target data with its client ID to determine whether the application is the correct recipient of the second target data.

[0211] Step 8020: If the validity verification is successful and the application is the correct recipient of the second target data, the encrypted information is decrypted based on the application's private key to obtain the business response data.

[0212] It should be noted that the process by which the application performs signature verification, validity verification, and decryption based on the second target data is similar to the process by which the system performs signature verification, validity verification, and decryption based on the first target data. This disclosed embodiment does not limit this process and will not elaborate further.

[0213] To implement the above embodiments, the ninth embodiment of this disclosure also proposes a data transmission device, wherein the device is applied to the data sender.

[0214] Figure 9 This is a schematic diagram of a data transmission device provided in the ninth embodiment of this disclosure.

[0215] like Figure 9 As shown, the data transmission device 900 includes: an acquisition module 901, an encryption module 902, a signature module 903, a processing module 904, and a sending module 905.

[0216] The system comprises the following modules: an acquisition module 901, which acquires the data to be transmitted and its data declaration information, including the set data transmission format and cryptographic algorithm; an encryption module 902, which encrypts the data to be transmitted based on the cryptographic algorithm to obtain encrypted data information; a signature module 903, which signs the data declaration information and encrypted data information based on the cryptographic algorithm to obtain a data signature; a processing module 904, which encapsulates the data declaration information, encrypted data information, and signature information according to the data transmission format to obtain the target data; and a sending module 905, which sends the target data to the data receiver.

[0217] As one possible implementation of this disclosure, the encryption module 902 is used to: parse the business request data to extract the business request subject and business request parameters when the data to be transmitted is business request data; obtain the public key of the data receiver, and encrypt the business request parameters based on the public key of the data receiver and the cryptographic algorithm to obtain ciphertext information; and generate data encryption information according to the business request subject and ciphertext information.

[0218] As one possible implementation of this disclosure, the encryption module 902 is used to: obtain the business request subject corresponding to the business request data when the data to be transmitted is business response data of business request data; obtain the public key of the data receiver, encrypt the business response data based on the public key of the data receiver and the cryptographic algorithm to obtain ciphertext information; and generate data encryption information according to the business request subject and the ciphertext information.

[0219] As one possible implementation of this disclosure, the encryption module 902 is used to: obtain data verification information, which is used to enable the data recipient to verify the validity of the target data; and generate data encryption information based on the business request subject, ciphertext information and data verification information.

[0220] As one possible implementation of this disclosure, the encryption module 902 is used to: generate a request data identifier corresponding to the service request data according to a set identifier generation rule when the data to be transmitted is service request data; determine the data acquisition time based on the time of acquiring the service request data and / or the time of acquiring the ciphertext information of the service request parameters; acquire the request data identifier corresponding to the service request data when the data to be transmitted is service response data of the service request data; determine the data acquisition time based on the time of acquiring the service response data and / or the time of acquiring the ciphertext information of the service response data; and determine data verification information based on the request data identifier and / or the data acquisition time.

[0221] As one possible implementation of this disclosure, the signature module 903 is used to: encode data declaration information based on a set encoding algorithm to obtain first encoded data, and encode data encryption information based on a set encoding algorithm to obtain second encoded data; connect the first encoded data and the second encoded data using a set data connector to obtain target encoded data; obtain the private key of the data sender, and sign the target encoded data based on the private key and cryptographic algorithm of the data sender to obtain data signature information.

[0222] As one possible implementation of this disclosure, the processing module 904 is used to: obtain the target encoded data corresponding to the data declaration information and the data encryption information; and use a data connector to connect the target encoded data and the data signature information to obtain the target data.

[0223] As one possible implementation of this disclosure, the acquisition module 901 is used to: when the data to be transmitted is business request data, acquire the data source identifier assigned by the data receiver to the data sender; generate data declaration information based on the data transmission format, cryptographic algorithm and data source identifier; wherein, the data source identifier is used to verify whether the data receiver is the correct receiver of the target data corresponding to the business response data.

[0224] As one possible implementation of this disclosure, the acquisition module 901 is used to: when the data to be transmitted is service response data of service request data, acquire data declaration information from the target data corresponding to the service request data.

[0225] It should be noted that the foregoing explanation of the data transmission method embodiment applied to the data sender also applies to the data transmission device of this embodiment, and will not be repeated here.

[0226] To implement the above embodiments, the tenth embodiment of this disclosure also proposes a data transmission device, wherein the device is applied to a data receiver.

[0227] Figure 10 This is a schematic diagram of a data transmission device provided in the tenth embodiment of this disclosure.

[0228] like Figure 10 As shown, the data transmission device 1000 includes: a receiving module 1001, a processing module 1002, a signature verification module 1003, and a decryption module 1004.

[0229] The system includes a receiving module 1001 for receiving target data from the data sender; a processing module 1002 for decapsulating the target data to obtain data declaration information, data encryption information, and data signature information of the data to be transmitted; wherein the data declaration information includes the data transmission format and cryptographic algorithm, the data encryption information is obtained by encrypting the data to be transmitted based on the cryptographic algorithm, and the data signature information is obtained by signing the data declaration information and the data encryption information based on the cryptographic algorithm; a signature verification module 1003 for performing signature verification based on the cryptographic algorithm and the data signature information; and a decryption module 1004 for decrypting the data encryption information based on the cryptographic algorithm if the signature verification is successful, to obtain the data to be transmitted.

[0230] As one possible implementation of this disclosure, the encrypted data information includes a business request subject and ciphertext information. The decryption module 1004 is used to: obtain the private key of the data recipient, and decrypt the ciphertext information based on the private key and the cryptographic algorithm to obtain plaintext information; when the data to be transmitted is business request data, determine the data to be transmitted based on the business request subject and plaintext information; when the data to be transmitted is business response data of the business request data, determine the data to be transmitted based on the plaintext information.

[0231] As one possible implementation of this disclosure, the data encryption information also includes data verification information, and the device further includes a validity verification module for performing validity verification on the target data based on the data verification information to obtain a validity verification result, so as to obtain the private key of the data recipient when the validity verification result indicates that the target data has passed the validity verification.

[0232] As one possible implementation of this disclosure, the data verification information includes the requested data identifier and / or the data acquisition time. The validity verification module is used to: query the identifier in historical data identifiers within a set historical time period based on the requested data identifier, and obtain the identifier query result; detect whether the data acquisition time meets the set time requirement, and obtain the time detection result; and determine the validity verification result based on the identifier query result and / or the time detection result.

[0233] As one possible implementation of this disclosure, the signature verification module 1003 is used to: obtain target encoded data, which includes first encoded data and second encoded data connected by a set data connector, wherein the first encoded data is obtained by encoding data declaration information based on a set encoding algorithm, and the second encoded data is obtained by encoding data encryption information based on a set encoding algorithm; obtain the public key of the data sender, and sign the target encoded data based on the public key of the data sender and the cryptographic algorithm to obtain signature information to be verified; and perform signature verification based on the signature information to be verified and the data signature information.

[0234] As one possible implementation of this disclosure, the data declaration information includes a data source identifier. When the data to be transmitted is business request data, the data source identifier is assigned by the data receiver to the data sender. The signature verification module 1003 is used to: query the public key of the data sender that matches the data source identifier from the public key library when the data to be transmitted is business request data.

[0235] As one possible implementation of this disclosure, the target data includes target encoded data and data signature information connected by a data connector. The decryption module 1004 is used to: decode the target encoded data based on a set encoding algorithm to obtain data declaration information and data encryption information; and decrypt the data encryption information based on the cryptographic algorithm included in the data declaration information to obtain the data to be transmitted.

[0236] As one possible implementation of this disclosure, the data declaration information includes a data source identifier, and the device further includes an identifier verification module for obtaining the data source identifier included in the data declaration information; and verifying whether the data recipient is the correct recipient of the target data based on the data source identifier.

[0237] It should be noted that the foregoing explanation of the data transmission method embodiment applied to the data receiver also applies to the data transmission device of this embodiment, and will not be repeated here.

[0238] Figure 11 This is a schematic diagram of the structure of an electronic device provided according to the eleventh embodiment of the present disclosure. The electronic device 1100 in this embodiment is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0239] like Figure 11 As shown, the above-mentioned electronic device 1100 includes:

[0240] The memory 1101 and the processor 1102 are connected by a bus 1103, which connects different components (including the memory 1101 and the processor 1102). The memory 1101 stores a computer program, and when the processor 1102 executes the program, it implements the data transmission method of the present disclosure embodiment.

[0241] Bus 1103 represents one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the various bus architectures. For example, these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0242] Electronic device 1100 typically includes a variety of electronic device readable media. These media can be any available media that can be accessed by electronic device 1100, including volatile and non-volatile media, removable and non-removable media.

[0243] Memory 1101 may also include computer system readable media in the form of volatile memory, such as random access memory (RAM) 1104 and / or cache memory 1105. Electronic device 1100 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 1106 may be used to read and write non-removable, non-volatile magnetic media (… Figure 11 Not shown; usually referred to as a "hard drive"). Although Figure 11 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk") and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 1103 via one or more data media interfaces. Memory 1101 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of this disclosure.

[0244] A program / utility 1108 having a set (at least one) of program modules 1107 may be stored, for example, in memory 1101. Such program modules 1107 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 1107 typically perform the functions and / or methods described in the embodiments of this disclosure.

[0245] Electronic device 1100 can also communicate with one or more external devices 1109 (e.g., keyboard, pointing device, display 1111, etc.), and with one or more devices that enable a user to interact with the electronic device 1100, and / or with any device that enables the electronic device 1100 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed via input / output (I / O) interface 1112. Furthermore, electronic device 1100 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1113. Figure 11 As shown, network adapter 1113 communicates with other modules of electronic device 1100 via bus 1103. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with electronic device 1100, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0246] The processor 1102 performs various functional applications and data processing by running programs stored in the memory 1101.

[0247] It should be noted that the implementation process and technical principles of the electronic device in this embodiment are explained in the foregoing description of the data transmission method of the present disclosure embodiment, and will not be repeated here.

[0248] To implement the above embodiments, this disclosure also proposes a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the foregoing embodiments. The computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, or optical data storage device, etc.

[0249] To implement the above embodiments, this disclosure also proposes a computer program product, including a computer program that, when executed by a processor, implements the methods provided in the foregoing embodiments.

[0250] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0251] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A data transmission method, characterized in that, When applied to the data sender, it includes the following steps: Obtain the data to be transmitted and the data declaration information of the data to be transmitted, wherein the data declaration information includes the set data transmission format and cryptographic algorithm; Based on the cryptographic algorithm, the data to be transmitted is encrypted to obtain encrypted data information, including: if the data to be transmitted is business request data, parsing the business request data to extract the business request subject and business request parameters; obtaining the public key of the data recipient, and encrypting the business request parameters based on the public key of the data recipient and the cryptographic algorithm to obtain ciphertext information; and generating the encrypted data information according to the business request subject and the ciphertext information. Based on the cryptographic algorithm, the data declaration information and the data encryption information are signed to obtain data signature information, including: based on the private key of the data sender, and according to the signature process of the cryptographic algorithm, the data declaration information and the data encryption information are signed based on the private key of the data sender to obtain data signature information. According to the data transmission format, the data declaration information, the data encryption information, and the data signature information are encapsulated to obtain the target data; The target data is sent to the data receiver.

2. The method according to claim 1, characterized in that, The step of encrypting the data to be transmitted based on the cryptographic algorithm to obtain encrypted data information includes: In the case where the data to be transmitted is service response data of service request data, the service request topic corresponding to the service request data is obtained; Obtain the public key of the data recipient, and encrypt the business response data based on the public key of the data recipient and the cryptographic algorithm to obtain ciphertext information; The data encryption information is generated based on the business request topic and the encrypted information.

3. The method according to claim 1 or 2, characterized in that, The step of generating the data encryption information based on the business request topic and the ciphertext information includes: Obtain data verification information, which is used to enable the data receiver to verify the validity of the target data; The data encryption information is generated based on the business request subject, the encrypted information, and the data verification information.

4. The method according to claim 3, characterized in that, The acquisition of data verification information includes: When the data to be transmitted is service request data, a request data identifier corresponding to the service request data is generated according to the set identifier generation rules; the data acquisition time is determined based on the time when the service request data is acquired, and / or the time when the encrypted information of the service request parameters is acquired. In the case where the data to be transmitted is service response data of service request data, obtain the request data identifier corresponding to the service request data; determine the data acquisition time based on the time of acquiring the service response data, and / or the time of acquiring the encrypted information of the service response data; The data verification information is determined based on the requested data identifier and / or the data acquisition time.

5. The method according to claim 1, characterized in that, The process of signing the data declaration information and the data encryption information based on the cryptographic algorithm to obtain data signature information includes: The data declaration information is encoded using a set encoding algorithm to obtain first encoded data, and the data encryption information is encoded using the set encoding algorithm to obtain second encoded data. Using a predefined data connector, the first encoded data and the second encoded data are connected to obtain the target encoded data; Obtain the private key of the data sender, and based on the private key of the data sender and the cryptographic algorithm, sign the target encoded data to obtain data signature information.

6. The method according to claim 5, characterized in that, The process of encapsulating the data declaration information, the data encryption information, and the data signature information according to the data transmission format to obtain the target data includes: Obtain the target encoded data corresponding to the data declaration information and the data encryption information; The target data is obtained by connecting the target encoded data and the data signature information using the data connector.

7. The method according to claim 1, characterized in that, Obtain the data declaration information of the data to be transmitted, including: If the data to be transmitted is service request data, obtain the data source identifier assigned by the data receiver to the data sender; and generate the data declaration information based on the data transmission format, the cryptographic algorithm, and the data source identifier. The data source identifier is used to verify whether the data recipient is the correct recipient of the target data corresponding to the business response data.

8. The method according to claim 7, characterized in that, Obtain the data declaration information of the data to be transmitted, including: In the case where the data to be transmitted is the service response data of the service request data, the data declaration information is obtained from the target data corresponding to the service request data.

9. A data transmission device, characterized in that, Applied to the data sender, including: The acquisition module is used to acquire the data to be transmitted and the data declaration information of the data to be transmitted, wherein the data declaration information includes the set data transmission format and cryptographic algorithm; An encryption module is used to encrypt the data to be transmitted based on the cryptographic algorithm to obtain encrypted data information, including: when the data to be transmitted is business request data, parsing the business request data to extract the business request subject and business request parameters, obtaining the public key of the data recipient, encrypting the business request parameters based on the public key of the data recipient and the cryptographic algorithm to obtain ciphertext information, and generating the encrypted data information according to the business request subject and the ciphertext information; The signature module is used to sign the data declaration information and the data encryption information based on the cryptographic algorithm to obtain data signature information, including: signing the data declaration information and the data encryption information based on the private key of the data sender and in accordance with the signature process of the cryptographic algorithm to obtain data signature information. The processing module is used to encapsulate the data declaration information, the data encryption information, and the data signature information according to the data transmission format to obtain the target data; The sending module is used to send the target data to the data receiver.

Images