Data transmission method and apparatus, electronic device, and storage medium

Abstract

The application provides a data transmission method and device, electronic equipment and storage medium, and relates to the technical field of data security. The method comprises the following steps: obtaining an original information element and determining whether the original information element is an information element to be encrypted; in response to determining that the original information element is an information element to be encrypted, determining a target virtual connection for transmitting the original information element from a plurality of virtual connections according to routing information in an information element header of the original information element; wherein the payload of the original information element carries user data; obtaining a key corresponding to the target virtual connection; wherein different virtual connections in the plurality of virtual connections have separate keys; encrypting the user data in the original information element according to the key corresponding to the target virtual connection to obtain an encrypted information element; and sending the encrypted information element to a receiving end. In the method, a separate key is used for each virtual connection. Even if one key is cracked, only the encrypted information element using the key is affected, and the information element on other virtual connections is not affected, so that the security of data transmission can be significantly improved.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a data transmission method, apparatus, electronic device and storage medium. Background Technology

[0002] Asynchronous Transfer Mode (ATM) networks are a core technology for implementing broadband integrated services digital networks. ATM is a connection-oriented transmission mode; ATM networks perform packet switching and multiplexing based on cells.

[0003] When a software system interfaces with external systems or when users log in to the software system via a network, an ATM network can be used to transmit data. This is especially important for data-intensive software systems where data security is paramount. Therefore, improving the security of ATM network data transmission is a pressing issue that needs to be addressed. Summary of the Invention

[0004] This application aims to at least partially address one of the technical problems in the related art.

[0005] Therefore, the first objective of this application is to propose a data transmission method to improve the security of data transmission.

[0006] The second objective of this application is to provide a data transmission device.

[0007] The third objective of this application is to propose an electronic device.

[0008] The fourth objective of this application is to provide a computer-readable storage medium.

[0009] The fifth objective of this application is to provide a computer program product.

[0010] To achieve the above objectives, a data transmission method is proposed in the first aspect of this application, comprising:

[0011] Obtain the original information element and determine whether the original information element is the information element to be encrypted;

[0012] In response to determining that the original cell is a cell to be encrypted, a target virtual connection for transmitting the original cell is determined from multiple virtual connections based on the routing information in the cell header of the original cell; wherein the payload of the original cell carries user data.

[0013] Obtain the key corresponding to the target virtual connection; wherein, different virtual connections among the plurality of virtual connections have separate keys;

[0014] Based on the key corresponding to the target virtual connection, the user data in the original information element is encrypted to obtain the encrypted information element;

[0015] The encrypted information is sent to the receiving end.

[0016] To achieve the above objectives, a second aspect of this application provides a data transmission apparatus, comprising:

[0017] The first determining module is used to acquire the original information element and determine whether the original information element is an information element to be encrypted;

[0018] The second determining module is configured to, in response to determining that the original cell is a cell to be encrypted, determine a target virtual connection for transmitting the original cell from multiple virtual connections based on the routing information in the cell header of the original cell; wherein the payload of the original cell carries user data.

[0019] The first acquisition module is used to acquire the key corresponding to the target virtual connection; wherein, different virtual connections among the plurality of virtual connections have separate keys;

[0020] The encryption module is used to encrypt the user data in the original information cell according to the key corresponding to the target virtual connection to obtain the encrypted information cell;

[0021] The sending module is used to send the encrypted information to the receiving end.

[0022] To achieve the above objectives, a third aspect of this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0023] The memory stores computer-executed instructions;

[0024] The processor executes computer execution instructions stored in the memory to implement the method as described in the first aspect embodiment.

[0025] To achieve the above objectives, a fourth aspect of this application provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, are used to implement the method described in the first aspect.

[0026] To achieve the above objectives, a fifth aspect of this application provides a computer program product including a computer program that, when executed by a processor, implements the method described in the first aspect.

[0027] The data transmission method, apparatus, electronic device, and storage medium provided in this application, when determining that the original information cell is the information cell to be encrypted, determine the target virtual connection for transmitting the original information cell from multiple virtual connections based on the routing information in the original information cell. Since different virtual connections among the multiple virtual connections have separate keys, the key corresponding to the target virtual connection can be obtained, and the user data carried in the payload of the original information cell can be encrypted using the key corresponding to the target virtual connection. Then, the encrypted information cell is sent to the receiving end to transmit the user data to the receiving end. Thus, different virtual connections have separate keys, and the information cell to be encrypted to be transmitted on the virtual connection can be encrypted using the key corresponding to each virtual connection. This achieves that each virtual connection uses a separate key, and even if one key is cracked, it only affects the information cell encrypted using that key, and will not affect the information cells on other virtual connections, which can significantly improve the security of data transmission.

[0028] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0029] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0030] Figure 1 This is a schematic flowchart illustrating a data transmission method provided in an embodiment of this application.

[0031] Figure 2 A flowchart illustrating another data transmission method provided in this application embodiment.

[0032] Figure 3 This is a flowchart illustrating another data transmission method provided in an embodiment of this application;

[0033] Figure 4 A flowchart illustrating a user data acquisition method provided in an embodiment of this application;

[0034] Figure 5 A schematic diagram illustrating the data flow in an ATM security subsystem provided in this application embodiment;

[0035] Figure 6 This is a schematic diagram of the structure of a data transmission device provided in an embodiment of this application;

[0036] Figure 7 This is a schematic diagram of the structure of an electronic device shown in an exemplary embodiment of the present disclosure. Detailed Implementation

[0037] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0038] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, data stored, data displayed, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0039] The technical solution of this application complies with the provisions of national laws and regulations regarding data acquisition, transmission, storage, use, and processing.

[0040] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0041] The data transmission method and apparatus of embodiments of this application are described below with reference to the accompanying drawings.

[0042] A cell is the basic transmission unit in an ATM network. A cell consists of a cell header and a payload. The cell header includes fields such as Virtual Path Identifier (VPI), Virtual Channel Identifier (VCI), payload type, and cell loss priority. The payload carries data, such as user data, operational information, and control information. Specifically, the VPI identifies different virtual paths in the ATM network, and the VCI further distinguishes different virtual channels within the same virtual path. A virtual channel is a logical connection.

[0043] A virtual path is a logical connection in an ATM network used to establish a path between multiple switching nodes. This path can carry multiple virtual channels. A single physical link can reuse multiple virtual paths, thereby improving network transmission efficiency. A virtual channel is a finer-grained logical connection built on top of a virtual path, used to transmit actual cell streams in an ATM network.

[0044] Figure 1 This is a flowchart illustrating a data transmission method provided in an embodiment of this application.

[0045] For example, the data transmission method of this application embodiment can be executed by a sending end with encryption function, or by an encryption device connected to the sending end, and there is no limitation thereto.

[0046] like Figure 1 As shown, the data transmission method includes the following steps:

[0047] Step 101: Obtain the original information cell and determine whether the original information cell is the information cell to be encrypted.

[0048] For example, the original information cell can be an information cell directly encapsulated by the sending end with encryption function according to the information to be transmitted, or an information cell received by the encryption device from the sending end, etc.

[0049] For example, the header of the original cell can be parsed to obtain the values ​​of fields such as VPI, VCI, and payload type. Based on the values ​​of these fields, the type of the original cell can be determined. Based on the type of the original cell, it can be determined whether the original cell is a cell to be encrypted. Here, the cell to be encrypted can refer to a cell whose payload carries user data.

[0050] For example, the payload type can be used to indicate the data type carried by the payload. If the value of the payload type field indicates that the data carried by the payload is user data, the type of the original cell can be determined to be a data cell, and the original cell can be considered as a cell to be encrypted. If the value of the payload type field indicates that the data carried by the payload is operation information, control information, etc., the type of the original cell can be determined to be a signaling cell, and the original cell can be considered as not a cell to be encrypted. If the value of the payload type field indicates Operation Administration and Maintenance (OAM) information, the type of the original cell can be determined to be an OAM cell, and the original cell can be considered as not a cell to be encrypted.

[0051] For example, if the values ​​of the VPI and VCI fields are specific, it indicates that the payload carries user data. If the values ​​of the VPI and VCI fields in the original cell are these specific values, then the original cell can be identified as a data cell, which is also the cell to be encrypted.

[0052] Step 102: In response to determining that the original cell is a cell to be encrypted, a target virtual connection for transmitting the original cell is determined from multiple virtual connections based on the routing information in the cell header of the original cell.

[0053] For example, the routing information in the cell header may include VPI and VCI, which together identify a virtual connection. There can be multiple virtual connections between two adjacent nodes. If the original cell is a cell to be encrypted, it means that the payload of the original cell carries user data. Based on the routing information in the cell header of the original cell, the target virtual connection for transmitting the original cell can be determined from multiple virtual connections. The target virtual connection can be understood as the virtual connection used to send the original cell to the next node.

[0054] Step 103: Obtain the key corresponding to the target virtual connection.

[0055] For example, different virtual connections among multiple virtual connections have separate keys. For example, the key corresponding to each virtual connection can be fixed or can be changed every preset time interval; there is no limitation in this regard. For example, the preset time interval can be set according to actual needs or obtained based on the cell transmission rate; there is no limitation in this regard.

[0056] For example, without considering the cell loss rate, the cell transmission rate can be obtained, and the synchronization period can be determined based on the cell transmission rate, setting the synchronization period to a preset duration. For example, the synchronization period without considering the cell loss rate can be calculated using the following formula (1):

[0057]

[0058] Where T1 represents the synchronization period without considering cell loss rate, and v0 represents the cell transmission rate. It can be seen that, without considering cell loss, key transformation is synchronized with cell transmission; that is, the key is changed once for each transmitted cell, and the key is rapidly changed according to different cells. This means that each destination address uses a unique key, thereby further improving the security of data transmission.

[0059] For example, considering the cell loss rate, the cell transmission rate, cell loss rate, and the quantitative relationship between the cell transmission rate and cell loss rate are obtained. Based on the cell transmission rate, cell loss rate, and quantitative relationship, the synchronization period is determined and set as a preset duration. For example, the synchronization period considering the cell loss rate can be calculated using the following formula (2):

[0060]

[0061] Where T2 represents the synchronization period considering the cell loss rate, clr represents the cell loss rate, and p represents the cell transmission rate v0 being p times the cell loss rate clr.

[0062] For example, if the cell transmission rate is 10 times the cell loss rate (p = 10), for a connection of 155.52 Mbit / s, when the cell loss rate clr = 10... -6 At that time, the synchronization period is If cell loss rate is not considered, the synchronization period is 0.27s × 10 -6 ×10=2.7μs. Taking the synchronization period as the key change time interval, it can be seen that when considering the cell loss rate, the key is changed once every 0.27s, and when not considering the cell loss rate, the key is changed once every 2.7μs.

[0063] For example, a keystore can be set up, which stores the keys corresponding to each virtual connection among multiple virtual connections. Then, the keystore can be queried based on the target virtual connection to obtain the key corresponding to the target virtual connection. For example, the key corresponding to each virtual connection in the keystore can be obtained based on the encryption algorithm corresponding to the virtual connection. Different virtual connections can have the same or different encryption algorithms. The key corresponding to each virtual connection in the keystore can be fixed or can change every preset time interval.

[0064] Therefore, the key can be directly obtained from the key store based on the virtual connection corresponding to the information to be encrypted, thereby improving encryption efficiency.

[0065] Step 104: Encrypt the user data in the original information cell according to the key corresponding to the target virtual connection to obtain the encrypted information cell.

[0066] In this embodiment, the user data carried in the payload can be encrypted using the key corresponding to the target virtual connection, while the cell header is still transmitted in plaintext. That is, the cell header in the encrypted cell is plaintext, and the payload carries the encrypted user data.

[0067] Step 105: Send encrypted cells to the receiving end.

[0068] In this embodiment, encrypted cells can be transmitted over the target virtual connection to be sent to the receiving end. For example, multiple encrypted cells can be merged into a single high-speed cell stream and output via a physical port.

[0069] Taking a bank cash management system as an example, the bank cash management system is a data-intensive system, and the security of the data is very important. When the bank cash management system is connected to an external system or when users log in through the network, they can use the ATM network. The data transmission method of the embodiment of this application can be used to encrypt and transmit data in the ATM network, thereby improving the security of data transmission.

[0070] In this embodiment, when the original information cell is determined to be the information cell to be encrypted, a target virtual connection for transmitting the original information cell is determined from multiple virtual connections based on the routing information in the original information cell. Since different virtual connections among the multiple virtual connections have separate keys, the key corresponding to the target virtual connection can be obtained, and the user data carried in the payload of the original information cell can be encrypted using the key corresponding to the target virtual connection. Then, the encrypted information cell is sent to the receiving end to transmit the user data to the receiving end. Thus, different virtual connections have separate keys, and the key corresponding to each virtual connection can be used to encrypt the information cell to be encrypted to be transmitted on the virtual connection. This achieves the use of a separate key for each virtual connection. Even if a key is cracked, it only affects the information cell encrypted using that key, and will not affect the information cells on other virtual connections, which can significantly improve the security of data transmission.

[0071] This embodiment provides another data transmission method. Figure 2 This is a schematic flowchart illustrating another data transmission method provided in an embodiment of this application.

[0072] like Figure 2 As shown, the data transmission method may include the following steps:

[0073] Step 201: Obtain the original information cell and determine whether the original information cell is the information cell to be encrypted.

[0074] In this application, step 201 can be implemented in any of the embodiments of this application, so it will not be described in detail here.

[0075] For example, the data transmission method in this embodiment is executed by an encryption device. A correspondence between the cell receiving port and the cell type of the encryption device can be established in advance. Cells of different cell types are received through different cell receiving ports. Thus, the cell type corresponding to the port receiving the original cell can be determined by querying the correspondence. The cell type corresponding to the port receiving the original cell is the type of the original cell. Then, based on the type of the original cell, it is determined whether the original cell is a cell to be encrypted.

[0076] For example, if the type of the original information cell is a data information cell, it can be determined that the original information cell is the information cell to be encrypted; if the type of the original information cell is a signaling information cell or an OAM information cell, it can be determined that the original information cell is not the information cell to be encrypted.

[0077] In ATM networks, signaling cells are used to transmit control information. They are responsible for establishing, maintaining, and releasing virtual connections, as well as performing other network control and management functions. The content of signaling cells typically includes control commands, status information, and address information, all crucial for the normal operation of the network. OAM cells are specifically designed for network operation and maintenance, transmitting maintenance information such as link status, error detection, and performance monitoring. The presence of OAM cells helps network operators promptly identify and resolve network problems, improving network reliability and availability. OAM cells include, for example, synchronization cells.

[0078] Therefore, based on the relationship between the cell receiving port and the cell type, the cell type corresponding to the port receiving the original cell can be determined, thereby determining the type of the original cell. This method is not only simple and convenient, but also relatively accurate.

[0079] Step 202: In response to determining that the original cell is a cell to be encrypted, a target virtual connection for transmitting the original cell is determined from multiple virtual connections based on the routing information in the cell header of the original cell.

[0080] In this application, step 202 can be implemented in any of the embodiments of this application, so it will not be described in detail here.

[0081] Step 203: Obtain the password parameters based on the routing information.

[0082] In this embodiment, if the original information cell is an information cell to be encrypted, the routing information in the original information cell can also be used to specify the cryptographic parameters used by the original information cell. The cryptographic parameters can be used to indicate the encryption algorithm used to encrypt the original information cell. Thus, the cryptographic parameters can be obtained based on the routing information, and the encryption algorithm to be used to encrypt the original information cell can be determined based on the cryptographic parameters.

[0083] Step 204: Based on the password parameters, determine the target password path corresponding to the password parameters from multiple password paths.

[0084] In this embodiment, multiple encryption algorithms can be supported. To prevent the misuse of encryption algorithms, these algorithms can be segmented using cryptographic paths. For example, multiple cryptographic paths can be provided, with different paths corresponding to different encryption algorithms. That is, one encryption algorithm can correspond to one cryptographic path. Each cryptographic path can include hardware devices that use the encryption algorithm corresponding to that path for encryption. For instance, a cryptographic path can include hardware devices such as a state vector memory, a communication encryption key memory, a cell processor, a key generator, and an encryptor that use the encryption algorithm corresponding to that path for encryption.

[0085] Since the cryptographic parameter is used to indicate the encryption algorithm used to encrypt the original information, and each cryptographic path has a corresponding encryption algorithm, the cryptographic path corresponding to the encryption algorithm indicated by the cryptographic parameter can be determined from multiple cryptographic paths based on the encryption algorithm indicated by the cryptographic parameter, and this cryptographic path can be determined as the target cryptographic path.

[0086] Step 205: Route the original information cells to the target cryptographic path, and use the key generator in the target cryptographic path to obtain the key corresponding to the target virtual connection.

[0087] In this embodiment, the original information cells can be routed to the target cryptographic path. Based on the encryption algorithm corresponding to the target cryptographic path, the key corresponding to the target virtual connection can be obtained using the key generator in the target cryptographic path. Here, the key generator can refer to a hardware device used to generate or match keys.

[0088] For example, routing information includes VPI and VCI, which together identify a virtual connection. VPI and VCI can also jointly specify cryptographic parameters, thus establishing a one-to-one relationship between the virtual connection and the cryptographic parameters. Therefore, based on the cryptographic path corresponding to the encryption algorithm specified in the cryptographic parameters of the original data cell, the key corresponding to the target virtual connection can be obtained. Furthermore, different virtual connections can have the same or different cryptographic parameters; that is, different virtual connections can have the same or different encryption algorithms.

[0089] Step 206: Encrypt the user data in the original information cell according to the key corresponding to the target virtual connection to obtain the encrypted information cell.

[0090] In this application, step 206 can be implemented in any of the embodiments of this application, so it will not be described in detail here.

[0091] Step 207: Send encrypted cells to the receiving end.

[0092] In this application, step 206 can be implemented in any of the embodiments of this application, so it will not be described in detail here.

[0093] For example, encrypted cells from multiple cryptographic paths can be merged into a single high-speed cell stream, sent out via a physical port, and then transmitted to the receiving end.

[0094] To ensure service quality, for example, cells sent out via the cryptographic path can be queued in a first-in-first-out (FIFO) queue, and then assembled into SONET (or SDH) frames according to the order in which they enter the FIFO queue and sent to the I / O port. This scheme is relatively simple and easy to implement.

[0095] For example, a buffer device can be set at the end of each cryptographic path. If there are multiple encrypted information cells, the multiple encrypted information cells can be cached in the buffer device corresponding to the target cryptographic path respectively. According to the delay time of the target cryptographic path, the encrypted information cells are buffered. Then, according to the order of the time when the multiple original information cells are routed to the corresponding target cryptographic path from earliest to latest, the encrypted information cells corresponding to the original information cells are obtained from the buffer device corresponding to each original information cell in turn to form an information cell stream, and the information cell stream is sent to the receiving end.

[0096] In this embodiment, the original information cells can be routed to the corresponding target cryptographic path. The original information cells are then encrypted via the target cryptographic path to obtain encrypted information cells. Caches of multiple encrypted information cells in the corresponding buffer devices of the target cryptographic path refer to buffer devices that cache the encrypted information cells at the end of the target cryptographic path to which the original information cells were routed. Alternatively, the buffer device corresponding to each original information cell can refer to a buffer device located at the end of the target cryptographic path to which the original information cells were routed.

[0097] As can be seen, each cryptographic path is equipped with a buffer device at the end, which can perform different degrees of buffering processing according to the different delay times of the encryption algorithms corresponding to each cryptographic path, so that the output cell stream maintains the same cell order as the input, which can greatly reduce latency jitter.

[0098] In this embodiment, multiple supported encryption algorithms can be segmented using cryptographic paths, so that different cryptographic paths correspond to different encryption algorithms. This achieves hardware segmentation of multiple encryption algorithms. For the original information cell that needs to be encrypted, the target cryptographic path can be determined based on the cryptographic parameters specified by the routing information in the original information cell. The original information cell is then routed to the corresponding cryptographic path to obtain the key corresponding to the target virtual connection. The original information cell is then encrypted using the key corresponding to the target virtual connection. This not only improves the security of data transmission but also prevents the abuse of encryption algorithms and reduces the probability of errors in the encryption process.

[0099] This embodiment provides another data transmission method. Figure 3 This is a schematic flowchart illustrating another data transmission method provided in an embodiment of this application.

[0100] like Figure 3 As shown, the data transmission method may include the following steps:

[0101] Step 301: Obtain the original information element and determine whether the original information element is the information element to be encrypted.

[0102] In this application, step 301 can be implemented in any of the embodiments of this application, so it will not be described in detail here.

[0103] Step 302: In response to determining that the original cell is a cell to be encrypted, a target virtual connection for transmitting the original cell is determined from multiple virtual connections based on the routing information in the cell header of the original cell.

[0104] In this application, step 302 can be implemented in any of the embodiments of this application, so it will not be described in detail here.

[0105] Step 303: Obtain the correspondence between virtual connections and password paths.

[0106] For example, a mapping between virtual links and cryptographic paths can be pre-established. For instance, a virtual link (VPI) and a cryptographic path (VCI) can be identified by a common virtual link. Different virtual links can correspond to different cryptographic paths, or they can correspond to the same cryptographic path; this is not limited.

[0107] In addition, different cryptographic paths correspond to different encryption algorithms, and any cryptographic path may include hardware devices used to perform encryption using the encryption algorithm corresponding to that cryptographic path.

[0108] Step 304: Determine the target cryptographic path corresponding to the target virtual link based on the correspondence between the virtual link and the cryptographic path and the target virtual link.

[0109] For example, based on the target virtual link, the target password path corresponding to the target virtual link can be determined by querying the correspondence between the virtual link and the password path, or the target virtual link can be matched with the virtual links in the correspondence, and the password path corresponding to the virtual link that matches the target virtual link can be used as the target password path.

[0110] Step 305: Route the original information cells to the target cryptographic path, and use the key generator in the target cryptographic path to obtain the key corresponding to the target virtual connection.

[0111] In this application, step 305 can be implemented in any of the embodiments of this application, so it will not be described in detail here.

[0112] Step 306: Encrypt the user data in the original information cell according to the key corresponding to the target virtual connection to obtain the encrypted information cell.

[0113] In this application, step 306 can be implemented in any of the embodiments of this application, so it will not be described in detail here.

[0114] Step 307: Send encrypted cells to the receiving end.

[0115] In this application, step 307 can be implemented in any of the embodiments of this application, so it will not be described in detail here.

[0116] In this embodiment, multiple supported encryption algorithms can be segmented using cryptographic paths, so that different cryptographic paths correspond to different encryption algorithms, thereby achieving hardware segmentation of multiple encryption algorithms. For the original information element that needs to be encrypted, the target cryptographic path corresponding to the target virtual connection can be determined based on the first correspondence between the virtual connection and the cryptographic path. The method is relatively simple. By routing the original information element to the corresponding cryptographic path, the key corresponding to the target virtual connection can be obtained, and then the original information element can be encrypted using the key corresponding to the target virtual connection. This not only improves the security of data transmission but also prevents the abuse of encryption algorithms and reduces the probability of errors in the encryption process.

[0117] In the above embodiments, if the type of the original information cell is an information cell to be encrypted, then the original information cell can be encrypted and sent to the receiving end. In one embodiment of this application, if the type of the original information cell is a non-real-time information cell, the original information cell can be stored in a first-in-first-out (FIFO) queue, and the original information cell can be transferred from the real-time channel to the non-real-time channel for transmission through the FIFO queue. The method for determining the type of the original information cell can be the one described in the above embodiments based on the correspondence between the information cell receiving port and the information cell type, or other methods described in the above embodiments can be used, and there is no limitation on this.

[0118] In this embodiment, non-real-time information cells can refer to information cells that do not carry user data, such as signaling information cells or OAM information cells. Alternatively, non-real-time information cells can refer to information cells that do not carry real-time service data but are used for network control, management, or maintenance. Non-real-time information cells typically do not have high real-time requirements for transmission and can be transmitted when the network load is low or within a specific time window in the network.

[0119] A real-time channel refers to a virtual channel with a data rate greater than a preset rate, while a non-real-time channel refers to a virtual channel with a data rate less than a preset rate. A real-time channel is a virtual channel used to transmit data with extremely high time requirements, ensuring that data can be transmitted with low latency, high reliability, and accuracy. A non-real-time channel is a virtual channel with less stringent time requirements for data transmission, allowing data to be transmitted over a relatively longer period. In a non-real-time channel, data transmission priority is usually lower, and it may be affected by factors such as network congestion and equipment failure.

[0120] For example, if the FIFO queue is to meet the transmission requirements of the real-time channel at full rate, the clock frequency of the FIFO queue must be high enough. Furthermore, since the rate of the non-real-time channel is typically much lower than that of the real-time channel—that is, the absolute value of the difference between the rates of the non-real-time and real-time channels is greater than a set threshold—the depth of the FIFO queue must also be large enough.

[0121] Therefore, if the original cell is a non-real-time cell, it can be stored in a first-in-first-out (FIFO) queue. Through the FIFO queue, the original cell can be transferred from the real-time channel to the non-real-time channel for transmission, so as to ensure that the transmission of the cell carrying user data in the real-time channel is not affected and the transmission requirements of the real-time channel are met.

[0122] In one embodiment of this application, if the original information cell is a synchronization information cell, an insertion operation can be performed on the synchronization information cell. For example, the current state vector can be read from the state vector memory and updated to obtain the updated state vector. The updated state vector is then written into the original information cell, and a cyclic check code is added to the original information cell to obtain a new synchronization information cell.

[0123] Among them, the cyclic check code can be used by the receiving end to perform integrity verification on new synchronization cells. If the new synchronization cell passes the verification, synchronization processing is performed based on the new synchronization cell.

[0124] For example, updating the current state vector may include incrementing the hop count by 1, setting the corresponding I / R bits, setting the sequence number and segment number to 0, and setting the value of the linear feedback shift register to the current value.

[0125] For example, adding a cyclic check code to the original cell can be done by adding a cyclic check to the end of the original cell so that the receiving end can perform integrity verification.

[0126] In addition to writing the updated state vector into the synchronization cell, the updated state vector can also be written back to the state vector memory for use in the next synchronization cell.

[0127] In this embodiment of the application, if the original information cell is a synchronization information cell, the updated state vector can be written into the original information cell, and a cyclic check can be added to the original information cell. In this way, while performing synchronization processing based on the synchronization information cell, the receiving end performs integrity verification on the synchronization information cell through the cyclic check code, which can improve the reliability of data transmission.

[0128] In the above embodiments, the user data can be obtained from an encrypted data table, i.e., a ciphertext table. For example, the data transmission method in the above embodiments is executed by a sending end with encryption functionality. The sending end can be a server, and the server obtains the user data from the ciphertext table. Alternatively, the data transmission method in the above embodiments can be executed by an encryption device, with the sending end being a server. The server obtains the user data from the ciphertext table and sends it to the encryption device for encryption via cells. Based on this, this embodiment provides another method for obtaining user data. Figure 4 This is a flowchart illustrating a user data acquisition method provided in an embodiment of this application.

[0129] like Figure 4 As shown, the user data acquisition method may include the following steps:

[0130] Step 401: In response to the data acquisition request from the target user, determine the ciphertext table to be queried based on the data acquisition request, and find the decryption parameters of the target user based on the user key of the target user.

[0131] The data retrieval request may include the target user's user key, the data information to be retrieved, etc. For example, the data information to be retrieved may refer to what data needs to be obtained; for instance, if a user wants to view their current balance, then the data information to be retrieved is the current balance.

[0132] In this embodiment, a ciphertext table containing the data information to be acquired can be determined based on the data information to be acquired in the data acquisition request.

[0133] For example, each target user has a corresponding user key and decryption parameters, and the decryption parameters of the target user can be found based on the user key.

[0134] Step 402: Encrypt the decryption parameters using the user key to obtain the first key encryption key.

[0135] In this embodiment, the decryption parameters can be encrypted using the user key to obtain the first key encryption key.

[0136] Step 403: In response to the first key encryption key being the same as the second key encryption key corresponding to the ciphertext table, perform an XOR operation on the first key encryption key and the row number, column number, and ciphertext table number corresponding to each ciphertext item to obtain the first key, second key, and third key for each ciphertext item.

[0137] In this embodiment, each ciphertext table or plaintext table is pre-set with a second key encryption key. If the first key encryption key is the same as the second key encryption key, it can be assumed that the target user can access the ciphertext table. The row number, column number, and ciphertext table number corresponding to each ciphertext item are determined. The first key encryption key is XORed with the row number, column number, and ciphertext table number of each ciphertext item to obtain the first key, the second key, and the third key.

[0138] The row and column numbers corresponding to each ciphertext item refer to the row number and column number of each ciphertext item in the ciphertext table.

[0139] Optionally, the first key encryption key and the position information of each ciphertext in the ciphertext table can be XORed to obtain the first key, second key and third key of each ciphertext. The position information of each ciphertext in the ciphertext table may include the row number of the row in the ciphertext table, the column number of the column in the ciphertext table and the sum of the row number and the column number, or the position information of each ciphertext in the ciphertext table may include the row number of the row in the ciphertext table, the column number of the column in the ciphertext table and the difference between the row number and the column number, etc.

[0140] Step 404: Based on the 3DES encryption algorithm, decrypt each ciphertext item in the ciphertext table according to the first key, the second key and the third key to obtain the plaintext table corresponding to the ciphertext table.

[0141] For example, the ciphertext can be decrypted for the first time using the third key, the first decryption result can be encrypted using the second key to obtain the encrypted result, and the encrypted result can be decrypted using the first key to obtain the corresponding ciphertext. Thus, by decrypting each ciphertext item in the ciphertext table, the corresponding plaintext table can be obtained.

[0142] Step 405: Obtain user data from the plaintext table according to the data acquisition request.

[0143] In this embodiment of the application, user data can be obtained from a plaintext table based on the data information to be obtained in the data acquisition request, and then the user data can be transmitted through information cells.

[0144] For example, the ciphertext table mentioned above can be obtained by encrypting a plaintext table based on the 3DES encryption algorithm. The plaintext table corresponds to multiple users, and each user has a user key. The plaintext table can be obtained by encrypting it using the following method: the row number, column number, and plaintext table number corresponding to each plaintext item can be determined. The second encryption key corresponding to the plaintext table can be XORed with the row number, column number, and plaintext table number corresponding to each plaintext item to obtain the first key, second key, and third key corresponding to each plaintext item. Then, based on the 3DES encryption algorithm, each plaintext item in the plaintext table is encrypted according to the first key, second key, and third key to obtain the ciphertext table.

[0145] For example, the plaintext is encrypted for the first time using the first key, then the result of the first encryption is decrypted using the second key, and then the result of the decryption is encrypted for the second time using the third key to obtain the ciphertext.

[0146] In addition, a user's user key, decryption parameters, and secondary encryption key can be linked in the following ways:

[0147] E(ku i ,p i )=E(kui ,D(ku i ,K k ))=K k

[0148] Where E represents the DES encryption algorithm, D represents the DES decryption algorithm, and ku i p represents the user key of the i-th user. i K represents the decryption parameters for the i-th user. k This indicates the second key encryption key.

[0149] For example, each user's decryption parameters can be associated as follows:

[0150] T i ={p i |p i =D(ku) i ,K k )},ku i ∈KU, i=1,2,…,n

[0151] Where n is the number of users, KU represents the set of user keys in the plaintext table to be encrypted, and T i This represents the function for generating decryption parameters for each user.

[0152] Therefore, the dynamic key generation encryption strategy based on the 3DES encryption algorithm can effectively avoid the large number of encryption keys generated by the massive amount of data, optimize key management, and provide a feasible encryption strategy for database security.

[0153] In this embodiment, if the first encryption key obtained based on the user key and decryption parameters of the target user is the same as the second encryption key corresponding to the ciphertext table, then three keys are obtained based on the first encryption key, the row number and column number of each ciphertext item, and the number of the ciphertext table. The ciphertext is decrypted using the three keys, thereby improving the security of data acquisition.

[0154] Taking a bank cash management system as an example, the database of the bank cash management system can be encrypted using the above method. When the bank cash management system is connected to an external system, or when a user logs into the bank cash management system to obtain data, the encrypted data table can be decrypted using the above decryption method to obtain user data. The information cells carrying user data can then be encrypted using the above encryption method, and the encrypted information cells can be transmitted in the ATM network to send the user data to the receiving end.

[0155] To facilitate understanding of the data transmission method of this application, further explanation is provided in conjunction with the following embodiments.

[0156] Taking data transmission executed by an encryption device as an example, the encryption device can include real-time and non-real-time components. The real-time component includes physical I / O modules, cell identification and association modules, cell routing modules, encryption modules, and cell merging modules, while the non-real-time component includes key management modules and non-real-time control modules. Alternatively, based on its relationship with an ATM, the encryption device can include a dedicated ATM subsystem and a secure encryption subsystem.

[0157] 1) ATM Dedicated Subsystem

[0158] like Figure 5 As shown, in this subsystem, the data flow starts from the I / O port, passes through the identification and association module, then passes through the cell routing module for cell routing, and after the data is sent to the encryption module for encryption or decryption, the data returns to the cell merging module and finally flows out through the I / O port.

[0159] (1) I / O ports

[0160] On the sending side, the I / O ports are used to receive raw data from the host and output encrypted data to the ATM network. On the receiving side, their function is to receive data from the network and send decrypted data back to the host.

[0161] (2) Identification and Association Module

[0162] ATM networks are connection-oriented, and the VPI / VCI fields in their cells are used to indicate connection information within the network and to specify the cryptographic parameters used by the cell. In encryption devices, when data is received from the I / O port, the ATM cell is first identified and associated.

[0163] (3) Non-real-time control module

[0164] This module provides control functions required by the encryption device itself but not requiring real-time processing, such as connection management and maintenance, and management of the encryption device itself. After cell identification, non-real-time cells, such as signaling cells, are transferred to the non-real-time control module. This means that cells are transferred from the high-speed real-time channel to the low-speed non-real-time channel. This process can be achieved through a first-in, first-out (FIFO) queue. If the FIFO queue is to meet the transmission requirements of the real-time channel at full rate, the clock frequency of the FIFO queue must be sufficiently high. Furthermore, since the rate of the non-real-time channel is much lower than that of the real-time channel, the depth of the FIFO queue must also be sufficiently large.

[0165] (4) Cell routing

[0166] When an encryption device supports multiple encryption algorithms, these algorithms can be segmented to prevent intentional or unintentional misuse; for example, each encryption algorithm can correspond to only one cryptographic path. Similarly, a cryptographic path can use its own unique hardware device, such as a state vector memory, communication encryption key memory, cell processor, key generator, and encryptor. Therefore, cell routers can route cells to the correct paths. For example, non-real-time cells are routed to the non-real-time control module, while all real-time cells are routed to their respective cryptographic paths.

[0167] For example, either a point-to-point structure or a bus structure can be used between the cell router and the cryptographic path. For instance, a PCI bus operating at 66MHz can support 64-bit data transmission, enabling the entire system to achieve a data transmission rate of 4.2Gbps.

[0168] From a security perspective, point-to-point structures are more conducive to the segmentation of multiple cryptographic paths, thereby ensuring that data encryption and decryption operations are always performed under the correct cryptographic parameters.

[0169] (5) Merging of Xinyuan

[0170] like Figure 5 As shown, the encryption module is connected to a cell merging module at the end, which is used to merge the data streams sent from multiple cryptographic paths into a high-speed cell stream, and then send it out through the physical port.

[0171] 2) Security Encryption Subsystem

[0172] The security encryption subsystem is a key component of the encryption device. It specifically implements the encryption of information cells, effectively preventing the illegal interpretation of intercepted data information, thereby ensuring the secure transmission of data in the ATM network.

[0173] (1) Encryption module

[0174] The encryption module may include a key generator, an encryptor, a state vector memory, a communication encryption key memory, and a cell processor.

[0175] Cells flowing through the cell processor can be of two types: data cells and security-related OAM cells (such as synchronization cells). For each cell, the cell processor needs to process it in real time; however, the processing performed by the cell processor varies depending on the cell type. For data cells, the cell processor can forward them to the key generator and encryptor for appropriate encryption and decryption; while for synchronization cells, the cell processor directly processes the synchronization data.

[0176] The processing of synchronization cells is described in the above embodiments, and will not be repeated here.

[0177] (2) Key Management

[0178] Key management itself is a non-real-time control component. Due to the sensitivity of key information, illegal disclosure of the communication encryption key storage must be prevented. To this end, a protected path can be established between the key management module and the encryption module. This can be achieved using a dual-port memory, connecting the key management module via a read / write port and the encryption module via a read-only port, establishing a point-to-point connection between the two modules. Furthermore, both the encryption module and the key management module receive the address information of the communication encryption key storage from the non-real-time control module.

[0179] To implement the above embodiments, this application also proposes a data transmission device. Figure 6 This is a schematic diagram of a data transmission device provided in an embodiment of this application.

[0180] like Figure 6 As shown, the data transmission device 600 includes:

[0181] The first determining module 610 is used to acquire the original information element and determine whether the original information element is an information element to be encrypted;

[0182] The second determining module 620 is configured to, in response to determining that the original cell is a cell to be encrypted, determine a target virtual connection for transmitting the original cell from multiple virtual connections based on the routing information in the cell header of the original cell; wherein the payload of the original cell carries user data.

[0183] The first acquisition module 630 is used to acquire the key corresponding to the target virtual connection; wherein, different virtual connections among the plurality of virtual connections have separate keys;

[0184] The encryption module 640 is used to encrypt the user data in the original information cell according to the key corresponding to the target virtual connection to obtain the encrypted information cell;

[0185] The sending module 650 is used to send the encrypted information to the receiving end.

[0186] Optionally, the routing information is further used to specify the cryptographic parameters used by the original information cell, the cryptographic parameters being used to indicate the encryption algorithm used to encrypt the original information cell, and the first acquisition module 630 is used to:

[0187] The password parameters are obtained based on the routing information;

[0188] Based on the password parameters, a target password path corresponding to the password parameters is determined from multiple password paths; wherein, different password paths correspond to different encryption algorithms, and any password path includes a hardware device used to perform encryption using the encryption algorithm corresponding to the password path;

[0189] The original information cells are routed to the target cryptographic path, and the key corresponding to the target virtual connection is obtained using the key generator in the target cryptographic path.

[0190] Optionally, the first acquisition module 630 is used for:

[0191] Obtain the correspondence between virtual connections and cryptographic paths; wherein, different cryptographic paths correspond to different encryption algorithms, and each cryptographic path includes a hardware device used to perform encryption using the encryption algorithm corresponding to the cryptographic path;

[0192] Based on the correspondence between virtual links and cryptographic paths and the target virtual link, the target cryptographic path corresponding to the target virtual link is determined;

[0193] The original information cells are routed to the target cryptographic path, and the key corresponding to the target virtual connection is obtained using the key generator in the target cryptographic path.

[0194] Optionally, a buffer device is provided at the end of each cryptographic path, and there are multiple encrypted cells. The sending module 650 is used for:

[0195] The encrypted information elements are respectively cached in the buffer device corresponding to the target cryptographic path;

[0196] The encrypted information element is buffered according to the delay time of the target cryptographic path;

[0197] According to the order of the time when the original information cells are routed to the corresponding target cryptographic path from earliest to latest, the encrypted information cells corresponding to the original information cells are sequentially obtained from the buffer device corresponding to each original information cell to form an information cell stream;

[0198] The cell stream is sent to the receiving end.

[0199] Optionally, the first acquisition module 630 is used for:

[0200] Based on the target virtual connection, obtain the key corresponding to the target virtual connection from the key store;

[0201] The key library stores the keys for each virtual connection, and the key for each virtual connection is determined according to the encryption algorithm corresponding to each virtual connection.

[0202] Optionally, the first determining module 610 is used for:

[0203] Obtain the correspondence between cell receiving ports and cell types;

[0204] The type of the original cell is determined based on the correspondence between the cell receiving port and the cell type, and the port that receives the original cell.

[0205] Based on the type of the original information element, determine whether the original information element is an information element to be encrypted.

[0206] Optionally, the device may further include:

[0207] A caching module is used to store the original information cell into a first-in-first-out queue in response to the original information cell being a non-real-time information cell, so that the original information cell can be transferred from the real-time channel to the non-real-time channel for transmission through the first-in-first-out queue;

[0208] Here, non-real-time information cells refer to information cells that do not carry user data, real-time channels refer to virtual channels with a rate greater than a preset rate, and non-real-time channels refer to virtual channels with a rate less than the preset rate.

[0209] Optionally, the device may further include:

[0210] The second acquisition module is used to read the current state vector from the state vector memory in response to the original information cell being a synchronization information cell;

[0211] The update module is used to update the current state vector to obtain the updated state vector;

[0212] The writing module is used to write the updated state vector into the original information cell and add a cyclic check code to the original information cell to obtain a new synchronization information cell;

[0213] The cyclic check code is used by the receiving end to perform integrity verification on the new synchronization cell, respond that the new synchronization cell passes the verification, and perform synchronization processing based on the new synchronization cell.

[0214] Optionally, the key corresponding to each virtual connection changes every preset time interval, which is determined in the following way:

[0215] Obtain the cell transmission rate, cell loss rate, and the quantitative relationship between the cell transmission rate and the cell loss rate;

[0216] The synchronization period is determined based on the cell transmission rate, the cell loss rate, and the quantity relationship.

[0217] The preset duration is determined based on the synchronization period.

[0218] Optionally, the user data is obtained through the following methods:

[0219] In response to receiving a data acquisition request from the target user, the encrypted table to be queried is determined according to the data acquisition request, and the decryption parameters of the target user are found according to the user key of the target user;

[0220] The decryption parameters are encrypted using the user key to obtain the first key encryption key;

[0221] In response to the first key encryption key being the same as the second key encryption key corresponding to the ciphertext table, an XOR operation is performed on the first key encryption key and the row number, column number, and ciphertext table number corresponding to each ciphertext item to obtain the first key, second key, and third key for each ciphertext item.

[0222] Based on the 3DES encryption algorithm, each ciphertext item in the ciphertext table is decrypted according to the first key, the second key and the third key to obtain the plaintext table corresponding to the ciphertext table;

[0223] According to the data acquisition request, the user data is obtained from the plaintext table.

[0224] It should be noted that the foregoing explanation of the data transmission method embodiment also applies to the data transmission device of this embodiment, and will not be repeated here.

[0225] In this embodiment, when the original information cell is determined to be the information cell to be encrypted, a target virtual connection for transmitting the original information cell is determined from multiple virtual connections based on the routing information in the original information cell. Since different virtual connections among the multiple virtual connections have separate keys, the key corresponding to the target virtual connection can be obtained, and the user data carried in the payload of the original information cell can be encrypted using the key corresponding to the target virtual connection. Then, the encrypted information cell is sent to the receiving end to transmit the user data to the receiving end. Thus, different virtual connections have separate keys, and the key corresponding to each virtual connection can be used to encrypt the information cell to be encrypted to be transmitted on the virtual connection. This achieves the use of a separate key for each virtual connection. Even if a key is cracked, it only affects the information cell encrypted using that key, and will not affect the information cells on other virtual connections, which can significantly improve the security of data transmission.

[0226] To implement the above embodiments, this application also proposes an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method provided in the foregoing embodiments.

[0227] To implement the above embodiments, this application also proposes an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method provided in the foregoing embodiments.

[0228] As an example, Figure 7 This is a schematic diagram of the structure of an electronic device shown in an exemplary embodiment of this disclosure, as follows: Figure 7 As shown, the aforementioned electronic device 700 may further include:

[0229] The system includes a memory 710 and a processor 720, and a bus 730 connecting different components (including the memory 710 and the processor 720). The memory 710 stores a computer program, and when the processor 720 executes the program, it implements the information acquisition method described in this embodiment of the present disclosure.

[0230] Bus 730 represents one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the various bus architectures. Examples of these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0231] Electronic device 700 typically includes a variety of electronic device readable media. These media can be any available media that can be accessed by electronic device 700, including volatile and non-volatile media, removable and non-removable media.

[0232] The memory 710 may also include computer system readable media in the form of volatile memory, such as random access memory (RAM) 740 and / or cache memory 750. The electronic device 700 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 760 can be used to read and write non-removable, non-volatile magnetic media (…). Figure 7 Not shown; usually referred to as a "hard drive"). Although Figure 7Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk") and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 730 via one or more data media interfaces. Memory 710 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of this disclosure.

[0233] A program / utility 780 having a set (at least one) of program modules 770 may be stored in, for example, memory 710. Such program modules 770 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 770 typically perform the functions and / or methods described in the embodiments of this disclosure.

[0234] Electronic device 700 can also communicate with one or more external devices 790 (e.g., keyboard, pointing device, display 791, etc.), and with one or more devices that enable a user to interact with electronic device 700, and / or with any device that enables electronic device 700 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed via input / output (I / O) interface 792. Furthermore, electronic device 700 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 793. As shown, network adapter 793 communicates with other modules of electronic device 700 via bus 730. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0235] The processor 720 executes various functional applications and data processing by running programs stored in the memory 710.

[0236] To implement the above embodiments, this application also proposes a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the foregoing embodiments.

[0237] To implement the above embodiments, this application also proposes a computer program product, including a computer program that, when executed by a processor, implements the methods provided in the foregoing embodiments.

[0238] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0239] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0240] This application is intended to provide an implementation scheme for users to selectively prevent the use or access to their personal information data. Specifically, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information is de-identified to protect user privacy.

[0241] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0242] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0243] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0244] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0245] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0246] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0247] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0248] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A data transmission method, characterized in that, The method includes the following steps: Obtain the original information cell and determine whether the original information cell is an information cell to be encrypted, wherein the information cell to be encrypted includes information cells with user data as the payload; In response to determining that the original cell is a cell to be encrypted, a target virtual connection for transmitting the original cell is determined from multiple virtual connections based on the routing information in the cell header of the original cell; wherein the payload of the original cell carries user data, the routing information in the cell header includes VPI and VCI, VPI and VCI jointly identify a virtual connection, and there are multiple virtual connections between two adjacent nodes; Obtain the key corresponding to the target virtual connection; wherein, different virtual connections among the plurality of virtual connections have separate keys, and the key corresponding to each virtual connection changes once every preset time interval, the preset time interval being determined by: obtaining the cell transmission rate, the cell loss rate, and the quantitative relationship between the cell transmission rate and the cell loss rate; determining the synchronization period based on the cell transmission rate, the cell loss rate, and the quantitative relationship; and determining the preset time interval based on the synchronization period. Based on the key corresponding to the target virtual connection, the user data in the original information cell is encrypted to obtain an encrypted information cell. The user data is obtained in the following way: In response to a data acquisition request from a target user, a ciphertext table to be queried is determined according to the data acquisition request, and the decryption parameters of the target user are found according to the user key of the target user; the decryption parameters are encrypted using the user key to obtain a first key encryption key; in response to the first key encryption key being the same as the second key encryption key corresponding to the ciphertext table, an XOR operation is performed on the first key encryption key and the row number, column number, and index of each ciphertext item in the ciphertext table to obtain a first key, a second key, and a third key for each ciphertext item; based on the 3DES encryption algorithm, each ciphertext item in the ciphertext table is decrypted according to the first key, the second key, and the third key to obtain a plaintext table corresponding to the ciphertext table; the user data is obtained from the plaintext table according to the data acquisition request. The encrypted information is sent to the receiving end.

2. The method as described in claim 1, characterized in that, The routing information is also used to specify the cryptographic parameters used by the original information cell, the cryptographic parameters being used to indicate the encryption algorithm used to encrypt the original information cell, and obtaining the key corresponding to the target virtual connection includes: The password parameters are obtained based on the routing information; Based on the password parameters, a target password path corresponding to the password parameters is determined from multiple password paths; wherein, different password paths correspond to different encryption algorithms, and any password path includes a hardware device used to perform encryption using the encryption algorithm corresponding to the password path; The original information cells are routed to the target cryptographic path, and the key corresponding to the target virtual connection is obtained using the key generator in the target cryptographic path.

3. The method as described in claim 1, characterized in that, The step of obtaining the key corresponding to the target virtual connection includes: Obtain the correspondence between virtual connections and cryptographic paths; wherein, different cryptographic paths correspond to different encryption algorithms, and each cryptographic path includes a hardware device used to perform encryption using the encryption algorithm corresponding to the cryptographic path; Based on the correspondence between virtual links and cryptographic paths and the target virtual link, the target cryptographic path corresponding to the target virtual link is determined; The original information cells are routed to the target cryptographic path, and the key corresponding to the target virtual connection is obtained using the key generator in the target cryptographic path.

4. The method as described in claim 2 or 3, characterized in that, Each cryptographic path is equipped with a buffer device at the end, and there are multiple encrypted information elements. Sending the encrypted information elements to the receiving end includes: The encrypted information elements are respectively cached in the buffer device corresponding to the target cryptographic path; The encrypted information element is buffered according to the delay time of the target cryptographic path; According to the order of the time when the original information cells are routed to the corresponding target cryptographic path from earliest to latest, the encrypted information cells corresponding to the original information cells are sequentially obtained from the buffer device corresponding to each original information cell to form an information cell stream; The cell stream is sent to the receiving end.

5. The method as described in claim 1, characterized in that, The step of obtaining the key corresponding to the target virtual connection includes: Based on the target virtual connection, obtain the key corresponding to the target virtual connection from the key store; The key library stores keys corresponding to each virtual connection, and the key for each virtual connection is determined according to the encryption algorithm corresponding to each virtual connection.

6. The method as described in claim 1, characterized in that, Determining whether the original information cell is an information cell to be encrypted includes: Obtain the correspondence between cell receiving ports and cell types; The type of the original cell is determined based on the correspondence between the cell receiving port and the cell type, and the port that receives the original cell. Based on the type of the original information element, determine whether the original information element is an information element to be encrypted.

7. The method as described in claim 6, characterized in that, Also includes: In response to the fact that the type of the original cell is a non-real-time cell, the original cell is stored in a first-in-first-out queue so that the original cell can be transferred from the real-time channel to the non-real-time channel for transmission through the first-in-first-out queue; Here, non-real-time information cells refer to information cells that do not carry user data, real-time channels refer to virtual channels with a rate greater than a preset rate, and non-real-time channels refer to virtual channels with a rate less than the preset rate.

8. The method as described in claim 1, characterized in that, Also includes: In response to the original information cell being a synchronization information cell, the current state vector is read from the state vector memory and updated to obtain the updated state vector; The updated state vector is written into the original information cell, and a cyclic check code is added to the original information cell to obtain a new synchronization information cell; The cyclic check code is used by the receiving end to perform integrity verification on the new synchronization cell, respond that the new synchronization cell passes the verification, and perform synchronization processing based on the new synchronization cell.

9. A data transmission device, characterized in that, include: The first determining module is used to acquire the original information cell and determine whether the original information cell is an information cell to be encrypted, wherein the information cell to be encrypted includes information cells with user data as the payload; The second determining module is configured to, in response to determining that the original cell is a cell to be encrypted, determine a target virtual connection for transmitting the original cell from multiple virtual connections based on the routing information in the cell header of the original cell; wherein the payload of the original cell carries user data, the routing information in the cell header includes VPI and VCI, VPI and VCI jointly identify a virtual connection, and there are multiple virtual connections between two adjacent nodes; The first acquisition module is used to acquire the key corresponding to the target virtual connection; wherein, different virtual connections among the plurality of virtual connections have separate keys, and the key corresponding to each virtual connection changes every preset time interval, the preset time interval being determined by: acquiring the cell transmission rate, the cell loss rate, and the quantitative relationship between the cell transmission rate and the cell loss rate; determining the synchronization period based on the cell transmission rate, the cell loss rate, and the quantitative relationship; and determining the preset time interval based on the synchronization period. An encryption module is used to encrypt user data in the original information cell according to the key corresponding to the target virtual connection to obtain encrypted information cells. The user data is obtained in the following way: in response to a data acquisition request from a target user, a ciphertext table to be queried is determined according to the data acquisition request, and the decryption parameters of the target user are found according to the user key of the target user; the decryption parameters are encrypted using the user key to obtain a first key encryption key; in response to the first key encryption key being the same as the second key encryption key corresponding to the ciphertext table, an XOR operation is performed on the first key encryption key and the row number, column number, and index of each ciphertext item in the ciphertext table to obtain a first key, a second key, and a third key for each ciphertext item; based on the 3DES encryption algorithm, each ciphertext item in the ciphertext table is decrypted according to the first key, the second key, and the third key to obtain a plaintext table corresponding to the ciphertext table; and the user data is obtained from the plaintext table according to the data acquisition request. The sending module is used to send the encrypted information to the receiving end.

10. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-8.

12. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1-8.

Images