Data secure transmission method and device, equipment and medium

Abstract

The invention relates to the technical field of data transmission security, in particular to a data security transmission method and device, equipment and a medium. And based on the first PQC signature algorithm and the first service data, generating a first PQC signature value of the first service data, adding the first PQC signature value to a preset position of the first data packet to obtain a second data packet, and sending the second data packet, so that the electronic equipment of the data receiver performs signature verification operation, and no matter which signature algorithm is used by the first service data for protection, the signature verification efficiency is improved. After the electronic equipment receives the first data packet, the electronic equipment uses a PQC signature algorithm to carry out signature processing on the first service data in the first data packet, and adds a determined first PQC signature value to a preset position of the first data packet, so that the electronic equipment of a data receiver can carry out verification. The purpose of adding the PQC signature algorithm in the data secure transmission process is achieved, the service processing logic of the data sender does not need to be modified, and resource waste is reduced.

Description

Technical Field

[0001] The present application relates to the technical field of data transmission security, and in particular to a data security transmission method, device, equipment and medium. Background Art

[0002] Cryptography is the cornerstone of information security. In terms of secure data transmission, key negotiation, identity authentication, encrypted transmission, etc. all rely on various cryptographic algorithms. At present, the security of cryptographic algorithms, especially public key cryptographic algorithms, is based on solving difficult mathematical problems, such as the RSA encryption algorithm based on the problem of large number decomposition, the elliptic curve cryptography algorithm ECC algorithm and DSA algorithm based on the discrete logarithm decomposition of elliptic curves, and my country's commercial cryptographic algorithm SM2. These cryptographic algorithms are almost impossible to crack with traditional computing power.

[0003] However, in 1994, mathematicians proposed a method that can use quantum computers to quickly decompose large integers and solve discrete logarithms at an exponential computing speed. With the rapid development of quantum computing technology, the computing performance of quantum computers has been continuously improved in recent years. The ability and practicality of quantum computers to perform specific tasks by manipulating quantum bits are becoming stronger and stronger. Quantum computing attacks based on the Shor algorithm are seriously impacting the security of modern cryptographic systems. If a quantum computer is attacked, the original business data is likely to be tampered with, thereby affecting the accuracy of quantum computing.

[0004] At present, there are a number of quantum-resistant algorithms that are considered to be able to resist the threat of quantum computing. The signature algorithms that are recognized as more promising include the lattice-based Dilithium series algorithms, the hash-based HSS (Hierarchical Semi-Separable Structure), SPHINCS+ (Stateless Hash-based Digital Signature) and other algorithms. These signature algorithms will be collectively referred to as post-quantum cryptography (Post-Quantum Cryptography, PQC) signature algorithms. At present, there are also some attempts to use the PQC signature algorithm in practical applications to solve the security risks of traditional security technologies in the face of quantum computing.

[0005] In the related technology, the PQC signature algorithm is generally used to replace the traditional signature algorithm to protect the data. However, directly replacing the traditional signature algorithm with the PQC signature algorithm will cause some existing OpenSSL-based security functions or the interface of the password card based on the existing standard to be unable to directly parse the data. All parts involving signatures and signature verification need to be modified, which requires a lot of human and material resources to be wasted.

[0006] Therefore, how to add the PQC signature algorithm during data security transmission and avoid excessive waste of resources has become an urgent problem to be solved. Summary of the invention

[0007] The embodiments of the present application provide a data security transmission method, device, equipment and medium to solve the problem of adding a PQC signature algorithm during data security transmission in the prior art that wastes a lot of resources.

[0008] The present application provides a data security transmission method, the method comprising:

[0009] Receive a first data packet sent by a data sender, and obtain first service data included in the first data packet;

[0010] Generate a first PQC signature value of the first service data based on a preconfigured first PQC signature algorithm and the first service data;

[0011] The first PQC signature value is added to a preset position of the first data packet to obtain a second data packet, and the second data packet is sent to an electronic device of a data recipient so that the electronic device of the data recipient performs a signature verification operation based on information included in the second data packet.

[0012] The present application provides a data security transmission device, the device comprising:

[0013] A receiving and obtaining module, configured to receive a first data packet sent by a data sender, and obtain first service data included in the first data packet;

[0014] A signature module, configured to generate a first PQC signature value of the first service data based on a preconfigured first PQC signature algorithm and the first service data;

[0015] A generating module, configured to add the first PQC signature value to a preset position of the first data packet to obtain a second data packet;

[0016] The sending module is used to send the second data packet to the electronic device of the data recipient, so that the electronic device of the data recipient performs a signature verification operation based on the information included in the second data packet.

[0017] The present application also provides an electronic device, which includes a processor, and the processor is used to implement the steps of any of the above-mentioned data security transmission methods when executing a computer program stored in a memory.

[0018] The present application also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the above-mentioned methods for secure data transmission.

[0019] In an embodiment of the present application, a first data packet sent by a data sender is received, and the first business data included in the first data packet is obtained. Based on a preconfigured first PQC signature algorithm and the first business data, a first PQC signature value of the first business data is generated, and the first PQC signature value is added to a preset position of the first data packet to obtain a second data packet, and the second data packet is sent to an electronic device of a data receiver, so that the electronic device of the data receiver performs a signature verification operation based on the information included in the second data packet. Regardless of the signature algorithm used by the data sender to protect the first business data when sending data, after receiving the first data packet, the electronic device uses the PQC signature algorithm to sign the first business data in the first data packet, and adds the determined first PQC signature value to the preset position of the first data packet, so as to facilitate verification by the electronic device of the data receiver, thereby achieving the purpose of adding a PQC signature algorithm in the process of secure data transmission, without the need to modify the business processing logic of the data sender, and reducing resource waste. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0021] Figure 1 A schematic diagram of a process flow of secure data transmission provided in an embodiment of the present application;

[0022] Figure 2 A schematic diagram of an IPv6 format provided in an embodiment of the present application;

[0023] Figure 3 A schematic diagram of storing relevant information of a PQC signature in a destination option header provided in an embodiment of the present application;

[0024] Figure 4 A schematic diagram of the IPv6 protocol structure provided in an embodiment of the present application;

[0025] Figure 5 A schematic diagram of the storage relationship between original business data and PQC signature related data provided in an embodiment of the present application;

[0026] Figure 6A schematic diagram of a data security transmission process provided in an embodiment of the present application;

[0027] Figure 7 A schematic diagram of a data security transmission process provided in an embodiment of the present application;

[0028] Figure 8 A schematic diagram of the structure of a data security transmission device provided in an embodiment of the present application;

[0029] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the embodiment of the present application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiment is only a part of the embodiment of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field belong to the scope of protection of this application.

[0031] An embodiment of the present application provides a method, apparatus, device and medium for secure data transmission, in which a first data packet sent by a data sender is received, and first business data included in the first data packet is obtained; a first PQC signature value of the first business data is generated based on a preconfigured first PQC signature algorithm and the first business data; the first PQC signature value is added to a preset position of the first data packet to obtain a second data packet, and the second data packet is sent to an electronic device of a data recipient, so that the electronic device of the data recipient performs a signature verification operation based on the information included in the second data packet.

[0032] The terms involved in this application are explained below.

[0033] PQC: also known as quantum-resistant algorithms, is a type of encryption algorithm designed to resist the potential threat of quantum computers. These algorithms are designed to supplement or replace existing encryption technologies to ensure that data security is not affected after the advent of quantum computers. Typical quantum-resistant cryptographic algorithms include Dilithium, SPHINCS+, etc.

[0034] Embodiment 1:

[0035] Figure 1 A flowchart of a data security transmission process provided by an embodiment of the present application is shown in FIG. Figure 1 As shown, the process includes the following steps:

[0036] S101: Receive a first data packet sent by a data sender, and obtain first service data included in the first data packet.

[0037] The data security transmission method provided in the present application is applied to an electronic device, which may be a server, a PC, a gateway device, etc.

[0038] In order to realize data transmission, in the embodiment of the present application, the data sender can send a first data packet carrying the first service data to the electronic device, and the electronic device forwards the first data packet after corresponding processing. The data sender can be a client, an application server, or other types of electronic devices.

[0039] The electronic device can receive a first data packet sent by a data sender, and the first data packet includes the first business data to be transmitted by the data sender. After obtaining the first data packet, the first business data included in the first data packet can be obtained. Since the format of the data packet used in the data transmission process is pre-negotiated by the parties involved in the data transmission, after obtaining the first data packet, the electronic device can parse the first data packet according to the pre-negotiated data packet format to obtain the first business data.

[0040] S102: Generate a first PQC signature value of the first service data based on a preconfigured first PQC signature algorithm and the first service data.

[0041] After obtaining the first business data in the first data packet, a first PQC signature value of the first business data can be generated based on a pre-configured first PQC signature algorithm and the first business data. How to determine the PQC signature value of data based on the PQC signature algorithm is prior art, and the embodiments of the present application will not go into details. Among them, the PQC signature algorithms include but are not limited to HSS, Dilithium2, Dilithium3, Dilithium5, SPHINCS+. Which PQC signature algorithm to use to determine the PQC signature value can be determined in advance by communication between the electronic device and the electronic device of the data recipient, or it can be pre-configured in the electronic device by relevant technicians.

[0042] S103: Add the first PQC signature value to a preset position of the first data packet to obtain a second data packet, and send the second data packet to an electronic device of a data recipient, so that the electronic device of the data recipient performs a signature verification operation based on information included in the second data packet.

[0043] After obtaining the first PQC signature of the first service data, the first PQC signature value can be added to the preset position of the first data packet to obtain the second data packet. The preset position can be the header or the tail of the data packet, for example, the first 128 characters of the data packet are used to store the first PQC signature, etc., and those skilled in the art can configure it as needed.

[0044] After obtaining the second data packet, the second data packet can be sent to the electronic device of the data recipient so that the electronic device of the data recipient performs a signature verification operation based on the information included in the second data packet. After receiving the second data packet, the electronic device of the data recipient can parse the data included in the data packet and perform a signature verification operation based on the PQC signature algorithm used when signing. If the electronic device performing the PQC signature communicates with the electronic device of the data recipient in advance about the PQC signature algorithm used, then the electronic device of the data recipient can perform a signature verification operation according to the pre-saved PQC signature algorithm after receiving the second data packet. If no communication is performed in advance, the electronic device performing the PQC signature can also add the algorithm information of the PQC signature algorithm used in the second data packet before transmitting the second data packet, so that the electronic device of the data recipient can parse the second data packet after receiving the second data packet, obtain the algorithm information of the PQC signature algorithm used and the first PQC signature value, and then perform a signature verification operation based on the PQC signature algorithm corresponding to the algorithm information.

[0045] In an embodiment of the present application, a first data packet sent by a data sender is received, and the first business data included in the first data packet is obtained. Based on a preconfigured first PQC signature algorithm and the first business data, a first PQC signature value of the first business data is generated, and the first PQC signature value is added to a preset position of the first data packet to obtain a second data packet, and the second data packet is sent to an electronic device of a data receiver, so that the electronic device of the data receiver performs a signature verification operation based on the information included in the second data packet. Regardless of the signature algorithm used by the data sender to protect the first business data when sending data, after receiving the first data packet, the electronic device uses the PQC signature algorithm to sign the first business data in the first data packet, and adds the determined first PQC signature value to the preset position of the first data packet, so as to facilitate verification by the electronic device of the data receiver, thereby achieving the purpose of adding a PQC signature algorithm in the process of secure data transmission, without the need to modify the business processing logic of the data sender, and reducing resource waste.

[0046] Embodiment 2:

[0047] In order to further improve the accuracy of the signature verification operation, based on the above embodiment, in the embodiment of the present application, after obtaining the first service data included in the first data packet, before generating the first PQC signature value of the service data based on the pre-configured first PQC signature algorithm and the first service data, the method further includes:

[0048] The first business data is hashed based on a preset hash algorithm to obtain a hash value, and the acquired first business data is updated using the hash value.

[0049] There will be a big difference between the two hash values ​​obtained after two sets of data with only one word difference are processed by the hash algorithm. Based on this, in an embodiment of the present application, after obtaining the first business data included in the first data packet, before generating the first PQC signature value of the first business data based on the pre-configured first PQC signature algorithm and the first business data, the first business data can also be hashed based on the hash algorithm to obtain a hash value. So that in the subsequent signature verification process, if the first business data is tampered with by one character, it can also be discovered in time. Among them, the hash algorithm includes but is not limited to SM3, SHA256, SHAKE256, and technicians in this field can configure it as needed.

[0050] After the hash value is obtained, the hash value can be used to update the acquired first business data. That is, during the signing process, the hash value of the first business data is used as the data to be signed, and the subsequent generation of the first PQC signature value is based on the hash value.

[0051] In order to further improve the accuracy of the signature verification operation, on the basis of the above embodiments, in the embodiment of the present application, the first PQC signature value is added to the preset position of the first data packet to obtain the second data packet, including:

[0052] The first PQC signature value and the first algorithm identification information of the hash algorithm are added to a preset position of the first data packet to obtain a second data packet.

[0053] In order to enable the electronic device of the data recipient to perform the same hash processing as the electronic device performing the PQC signature when performing the signature verification operation, in an embodiment of the present application, when the electronic device generates the second data packet, it can add the first PQC signature value and the first algorithm identification information of the hash algorithm to the preset position of the first data packet to obtain the second data packet. Among them, the first algorithm identification information of the hash algorithm can be the name of the hash algorithm used; it can also be the identification information added in advance for the hash algorithm, and the identification information is used to uniquely identify the corresponding hash algorithm; it can also be the file information of the file that stores the execution code of the hash algorithm, such as the storage location of the file, and the file name. After parsing the first algorithm identification information, the electronic device of the data recipient can search for the corresponding file name in the storage location, thereby obtaining the execution code of the corresponding hash algorithm.

[0054] Embodiment 3:

[0055] In order to further ensure the security of data transmission, based on the above embodiments, in the embodiment of the present application, the method further includes:

[0056] If a third data packet sent by another electronic device is received, and the third data packet includes a second PQC signature value, the second service data in the third data packet is obtained, and the second PQC signature value is identified at the preset position of the third data packet;

[0057] Performing a signature verification operation based on a pre-configured second PQC signature algorithm, a public key, the second PQC signature value, and the second service data to determine whether the third data packet has been attacked, wherein the public key is a public key corresponding to a private key used to generate the second PQC signature;

[0058] If yes, the third data packet is intercepted.

[0059] Data transmission is generally bidirectional, and the electronic device can also receive a third data packet sent by other electronic devices, and the third data packet includes the second PQC signature value. In other words, the electronic device can also receive the third data packet signed by other electronic devices, and perform a signature verification operation based on the information included in the third data packet.

[0060] After receiving the third data packet, the second business data in the third data packet can be obtained, and the second PQC signature value can be identified at a preset position in the third data packet, wherein the preset position is consistent with the preset position for adding the first PQC signature value in the first data packet in the above embodiments.

[0061] After obtaining the second PQC signature value in the third data packet, a signature verification operation can be performed based on the pre-configured second PQC signature algorithm, public key, second PQC signature value and second business data to determine whether the third data packet has been attacked. Among them, the public key is the public key corresponding to the private key used when generating the second PQC signature. The public key can be carried in the third data packet and sent together with the second PQC signature value, or it can be sent in advance to the electronic device by the other electronic device. How to perform the signature verification operation is a prior art, and the embodiments of the present application will not be repeated here.

[0062] If it is determined through the signature verification operation that the third data packet has been attacked, it means that the data included in the third data packet may have been tampered with. In order to ensure the security of data transmission, in an embodiment of the present application, the third data packet can be intercepted and processed, for example, a prompt message of a data packet error is fed back to the other electronic device.

[0063] If it is determined through the signature verification operation that the third data packet has not been attacked, it means that the third data packet is temporarily safe through the signature verification operation, and the third data packet can be subsequently processed, for example, the third data packet can be forwarded to the application server so that the application server can perform corresponding business operations on the second business data included in the third data packet.

[0064] In order to further improve the accuracy of the signature verification operation, on the basis of the above embodiments, in an embodiment of the present application, if the third data packet includes second algorithm identification information of the hash algorithm, after the second PQC signature value is identified at the preset position of the third data packet, before the signature verification operation is performed based on the pre-configured second PQC signature algorithm, public key, the second PQC signature value and the second business data, the method further includes:

[0065] The second business data is hashed based on the hash algorithm corresponding to the second algorithm information to obtain a hash value, and the second business data is updated using the hash value.

[0066] In an embodiment of the present application, if the received third data packet includes the second algorithm identification information of the hash algorithm, it means that the data in the third data packet has been hashed when performing the signature operation, and the second PQC signature value in the third data packet is generated based on the hash value of the corresponding business data. Then, after obtaining the second PQC signature value, before performing the signature verification operation based on the pre-configured second PQC signature algorithm, public key, second PQC signature value and second business data, the second business data can also be hashed based on the hash algorithm corresponding to the second algorithm information carried in the third data packet to obtain a hash value, and the second business data can be updated using the hash value to facilitate the subsequent signature verification operation based on the hash value.

[0067] Embodiment 4:

[0068] In order to further ensure the security of data transmission, on the basis of the above embodiments, in an embodiment of the present application, the preset position is the destination header option of the data packet.

[0069] In the embodiment of the present application, during the data transmission process, each data packet transmitted may be in the Internet Protocol Version 6 (IPv6) protocol format. Figure 2 A schematic diagram of an IPv6 format provided in an embodiment of the present application, such as Figure 2 As shown, the IPv6 protocol consists of a basic header and a payload, and the payload consists of an extension header and a data part, wherein the extension header is an optional item. In an actual message, there may be no extension header, one extension header, or multiple extension headers, depending on actual needs. The extension header includes a destination option header. In an embodiment of the present application, the relevant information of the PQC signature may be stored in the destination option header. The relevant information of the PQC signature may include at least one of the first PQC signature value, the second PQC signature value, the algorithm information of the PQC signature algorithm, the public key, the first algorithm information of the hash algorithm, and the second algorithm information of the hash algorithm described in the above embodiments. In an embodiment of the present application, the destination option header storing the relevant information of the PQC signature and the data part together constitute the payload part of the IPv6 protocol. Therefore, in an embodiment of the present application, when performing encryption communication, the IPv6 protocol contains at least one extension header, namely the destination option extension header.

[0070] Specifically, the destination option header may include multiple options encoded in TLV (Tag-Length-Value) mode, and may store multiple groups of information. Figure 3 A schematic diagram of storing the relevant information of a PQC signature in the destination option header provided in an embodiment of the present application, such as Figure 3As shown, the algorithm information of the PQC signature algorithm, the public key, the algorithm information of the hash algorithm, and the PQC signature value can be stored in each option of the destination header option. For example, the algorithm information of the PQC signature algorithm is stored in option 1, the public key is stored in option 2, and so on. Among them, the algorithm information of the hash algorithm may include the first algorithm information and the second algorithm information described in the above embodiments, and the PQC signature value may include the first PQC signature value and the second PQC signature value described in the above embodiments. The above destination header options are TLV-coded. Therefore, when the PQC signature information is stored in the extended header, it is not limited by the order and number. According to the actual use scenario requirements and design, different PQC signature related information can be selected to store. At least one information needs to be stored, that is, the PQC signature value. This situation can minimize the problem of additional data increase caused by the PQC signature. At most, the PQC signature algorithm, the PQC signature public key, the PQC signature value, and the related information of the algorithm for hashing the business data can be stored in the extended header.

[0071] In summary, from the perspective of the overall structure of data packets, the positions of service data and PQC signature related data in the IPv6 protocol are as follows: Figure 4 As shown, Figure 4 A schematic diagram of an IPv6 protocol structure provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, the IPv6 protocol format mainly includes a basic header, an extended header and a data part, wherein the extended header stores the relevant information of the PQC signature, and the data part stores the original service data, i.e., the first service data or the second service data described in the above embodiments. The PQC signature information and the original service information are stored separately, so that the storage will not cause significant interference to the subsequent service processing flow.

[0072] The components of the data packet are described below in conjunction with a specific embodiment. Figure 5 A schematic diagram of the storage relationship between the original business data and the PQC signature related data provided in the embodiment of the present application. Figure 5As shown, the first business data in the first data packet sent by the data sender may be business data composed of signatures based on the traditional signature algorithm. The first business data may contain the following data: original data m, hash value h of m, public key / public key certificate e, signature algorithm alg and digital signature value c. Depending on the selected signature mode and the processing logic during application design, the data categories included may be different. The signature information generated by the PQC signature algorithm is stored in the extended header of the protocol without changing the composition of the original business data. It uses the entire original business data data as the data to be signed by the PQC signature algorithm without having to care about the composition of the original business data, that is, it generates the relevant information of the PQC signature based on all the data recorded in the data part data of the protocol. The relevant information of the PQC signature may include: PQC digital signature value c', PQC signature public key e', algorithm information of the PQC signature algorithm and other information. If the two-way sending system agrees on the PQC signature algorithm and imports the PQC public keys of both parties, the PQC signature information in the extended header may only contain the PQC digital signature value c'. That is to say, the PQC signature public key e' and the algorithm information of the PQC signature algorithm are optional.

[0073] The relevant information of the PQC signature of this application is stored in the extended header. Based on the storage method encoded in the TLV mode, the reading of the relevant information of the PQC signature does not depend on the storage location of each information item, and can be stored at will, and can be automatically identified when reading. The number of stored signature data information items depends on the algorithm and policy requirements, and the total length depends on the protocol's limit on the maximum length of a single data packet. Therefore, in the specific transformation process, the number of relevant information of the PQC signature that needs to be stored can be flexibly determined according to different usage scenarios (for example, the same algorithm can only store the PQC signature value according to the policy, and other information items can be shared according to the agreement of both parties or prior negotiation, and multiple or all PQC signature information items can also be stored; in different algorithm scenarios, the HSS algorithm has additional auxiliary information compared to the Dilithium algorithm, and this solution can dynamically support the two algorithms very well), thereby meeting various requirements for algorithm flexibility, high transmission efficiency, etc. in different scenarios.

[0074] In the embodiment of the present application, the number of relevant information items storing the PQC signature can be flexibly changed according to demand, and the reading of the information items does not depend on the storage order. Therefore, compared with the traditional PQC signature scheme, the flexibility and scalability of the PQC signature algorithm are stronger, and can meet the current and future expansion requirements of the PQC signature algorithm.

[0075] Embodiment 5:

[0076] Combine the following Figure 6 Explain the data security transmission process. Figure 6A schematic diagram of a data security transmission process provided by an embodiment of the present application. The data security transmission process mainly includes a signature device and a signature verification device. Among them, the signature device is mainly used to generate and send a second data packet, and the signature verification device is mainly used to receive and process the second data packet.

[0077] In the embodiment of the present application, the business data is denoted as M, the algorithm for performing hash calculation on M is denoted as H, the data obtained after the business data is calculated by the H algorithm is denoted as M', the PQC signature algorithm is denoted as ALG, the public-private key pair is denoted as PK and SK, wherein PK is the public key, SK is the private key, and the PQC signature value is denoted as SIG.

[0078] The process of the signature device generating the second data packet mainly includes the following steps:

[0079] Step 1: Receive the first data packet sent by the data sender, and obtain the first service data M included in the first data packet. Obtain the data to be signed M'=H(M) with the PQC signature.

[0080] Step 2: Generate a PQC public-private key pair, GEN(ALG,PK,SK), where GEN is the function for generating a public-private key pair, PK and SK are public-private key pairs of specified length, and their length is related to the PQC signature algorithm type ALG.

[0081] Step 3: Generate a PQC signature value, SIGN(ALG,M',SK,SIG), where SIGN is the mathematical representation of the signature function, ALG is the selected PQC signature algorithm, SK is the signature private key, and SIG is the calculation result, i.e., the PQC signature value.

[0082] Step 4: Add H, ALG, PK and SIG to the extended header as relevant information of the PQC signature and add them to the first data packet to obtain the second data packet and send it to the electronic device of the data recipient, i.e., the signature verification device.

[0083] The signature verification process of the signature verification device mainly includes the following steps:

[0084] Step 1: Receive the second data packet and parse the second data packet to obtain the basic header, extended header (data related to the PQC signature) and data part (business data M).

[0085] Step 2: Further analyze the extended header and data part to obtain M, H, ALG, PK and SIG.

[0086] Step 3: Get the data to be signed with the PQC signature, M'=H(M).

[0087] Step 4: Verify the PQC signature and call the verification function VERIFY(ALG, M', PK, SIG) to complete the verification. VERIFY is a mathematical representation of the verification operation and does not represent a specific verification function.

[0088] Step 5: Continue to execute the original business processing flow, including using traditional security technologies to process business data, and performing logical operations and data processing at the application business layer.

[0089] Through the above steps, it can be known that the verification process of the PQC signature in the embodiment of the present application and the process of verifying the original business data using traditional security technology do not affect each other, nor do they affect the original business layer processing logic. When performing PQC signature processing, there is no need to understand the specific form and structure of the business data. The original business data can be plain text or data processed by any technical means, because the PQC signature is signed and confirmed with the entire original business data as a parameter factor. The generation of PQC signature values ​​and PQC signature verification can be performed relatively independently through component calls and interceptors, and even the relevant processing operations of the PQC signature can be implemented in the front-end system or security gateway.

[0090] Combine the following Figure 7 Explain the data security transmission process. Figure 7 A schematic diagram of a data security transmission process provided in an embodiment of the present application. Figure 7 The traditional signature verification process and the signature verification process provided by this application are included, and a comparison is given below.

[0091] When using traditional signature algorithms to protect business data between business systems, application server A calls signature verification server A to sign the data to form the business data to be sent, which is sent to gateway B via gateway A. Gateway B receives the data and forwards it to application server B. Application server B calls signature verification server B to verify the business data and complete the business operation.

[0092] After adding the PQC signature algorithm described in this application, the original application server A, signature verification server A, application server B and signature verification server B do not involve modification. Only gateway A and gateway B need to be modified to support PQC signature verification.

[0093] The PQC signature verification SDK plug-in is deployed in Gateway A and Gateway B, which encapsulates the PQC signature verification algorithm. The SDK plug-in connects to the PQC signature verification server (functions can be expanded on the traditional signature verification server to support PQC signature verification).

[0094] When the business data sent by application server A reaches gateway A, gateway A calls the SDK plug-in to add relevant information of the PQC signature to the IPv6 protocol extension header, obtains the second data packet, and sends it to gateway B. After receiving the second data packet, gateway B calls the SDK plug-in to verify the PQC signature. If the PQC signature verification fails, the data is intercepted and an error message is returned. If the PQC signature verification passes, the original business data is sent to application server B. Application server B calls signature verification server B to verify the business data and complete the business operation.

[0095] In summary, in the embodiments of the present application, by adding anti-quantum signatures, it is possible to resist attacks by quantum computing technology on the original signature technology; the anti-quantum part and the original business data are relatively separated and have low coupling, and adding anti-quantum signatures has no impact on the original business; it is flexible and conducive to expansion, and can dynamically support multiple hash algorithms and anti-quantum technologies.

[0096] The data security transmission method provided by this application mainly includes the following advantages:

[0097] The independence of PQC signature protection measures and traditional security technologies and business processing. The entire original business data is used as the input of the PQC signature, and there is no need to care about the data format and composition structure of the original business data; PQC signature related information is stored in the extended header of the IP protocol, and the storage location is not related to the original business data. Therefore, adding the PQC signature does not affect the processing logic and flow of the original business data.

[0098] The diversity of PQC signature algorithms supported and the flexibility of PQC signature information transmission types. Based on the data storage of the IP protocol extension header, the destination option extension header supports multiple options encoded in TLV mode. The PQC signature algorithm type, the algorithm type for hashing the original business data, and other information can be stored in the destination option extension header, which can support multiple PQC signature algorithms and hash algorithms, and can also well support subsequent extension algorithms. Based on the storage method encoded in TLV mode, the stored information is not affected by the storage order, because each option information contains the data type and data length fields, which can be parsed by itself. In this case, under the default policy and mutual agreement, the transmitted PQC signature information can be as few as the PQC signature value without affecting the verification of the PQC signature. Therefore, it can better adapt to the needs of different scenarios such as those that tend to be high flexibility or high transmission efficiency.

[0099] The data security transmission method provided in this application is applicable to data transmission scenarios based on the IPv6 protocol, and uses quantum-resistant cryptographic technology to resist quantum computing attacks and counterfeiting of traditional digital signatures.

[0100] Embodiment 6:

[0101] Based on the above embodiments, Figure 8 A schematic diagram of a data security transmission device provided in an embodiment of the present application, the device comprising:

[0102] The receiving and obtaining module 801 is configured to receive a first data packet sent by a data sender, and obtain first service data included in the first data packet;

[0103] A signature module 802, configured to generate a first PQC signature value of the first service data based on a preconfigured first PQC signature algorithm and the first service data;

[0104] A generating module 803 is configured to add the first PQC signature value to a preset position of the first data packet to obtain a second data packet;

[0105] The sending module 804 is used to send the second data packet to the electronic device of the data recipient, so that the electronic device of the data recipient performs a signature verification operation based on the information included in the second data packet.

[0106] In a possible implementation, the device further includes:

[0107] The encryption module 805 is used to perform hash processing on the first business data based on a preset hash algorithm to obtain a hash value, and use the hash value to update the obtained first business data.

[0108] In a possible implementation manner, the generating module 803 is specifically configured to add the first PQC signature value and the first algorithm identification information of the hash algorithm to a preset position of the first data packet to obtain a second data packet.

[0109] In a possible implementation, the receiving and obtaining module 801 is further configured to, if a third data packet sent by another electronic device is received, and the third data packet includes a second PQC signature value, obtain the second service data in the third data packet, and identify the second PQC signature value at the preset position of the third data packet;

[0110] A signature verification module 806 is used to perform a signature verification operation based on a pre-configured second PQC signature algorithm, a public key, the second PQC signature value, and the second service data to determine whether the third data packet has been attacked, wherein the public key is a public key corresponding to a private key used to generate the second PQC signature;

[0111] The processing module 807 is used to intercept the third data packet if it is determined that the third data packet is attacked.

[0112] In a possible implementation, the encryption module 805 is further configured to perform hash processing on the second business data based on a hash algorithm corresponding to the second algorithm information to obtain a hash value, and use the hash value to update the second business data.

[0113] Embodiment 7:

[0114] Based on the above embodiments, the present application also provides an electronic device, Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Fig. 9 As shown, it includes: a processor 901, a communication interface 902, a memory 903 and a communication bus 904, wherein the processor 901, the communication interface 902, and the memory 903 communicate with each other through the communication bus 904;

[0115] The memory 903 stores a computer program. When the program is executed by the processor 901, the processor 901 performs the following steps:

[0116] Receive a first data packet sent by a data sender, and obtain first service data included in the first data packet;

[0117] Generate a first PQC signature value of the first service data based on a preconfigured first PQC signature algorithm and the first service data;

[0118] The first PQC signature value is added to a preset position of the first data packet to obtain a second data packet, and the second data packet is sent to an electronic device of a data recipient so that the electronic device of the data recipient performs a signature verification operation based on information included in the second data packet.

[0119] In a possible implementation, after acquiring the first service data included in the first data packet, and before generating a first PQC signature value of the first service data based on a preconfigured first PQC signature algorithm and the first service data, the method further includes:

[0120] The first business data is hashed based on a preset hash algorithm to obtain a hash value, and the acquired first business data is updated using the hash value.

[0121] In a possible implementation manner, adding the first PQC signature value to a preset position of the first data packet to obtain a second data packet includes:

[0122] The first PQC signature value and the first algorithm identification information of the hash algorithm are added to a preset position of the first data packet to obtain a second data packet.

[0123] In a possible implementation, the method further includes:

[0124] If a third data packet sent by another electronic device is received, and the third data packet includes a second PQC signature value, the second service data in the third data packet is obtained, and the second PQC signature value is identified at the preset position of the third data packet;

[0125] Performing a signature verification operation based on a pre-configured second PQC signature algorithm, a public key, the second PQC signature value, and the second service data to determine whether the third data packet has been attacked, wherein the public key is a public key corresponding to a private key used to generate the second PQC signature;

[0126] If yes, the third data packet is intercepted.

[0127] In a possible implementation, if the third data packet includes second algorithm identification information of a hash algorithm, after identifying the second PQC signature value at the preset position of the third data packet, and before performing a signature verification operation based on a preconfigured second PQC signature algorithm, a public key, the second PQC signature value, and the second business data, the method further includes:

[0128] The second business data is hashed based on the hash algorithm corresponding to the second algorithm information to obtain a hash value, and the second business data is updated using the hash value.

[0129] In a possible implementation manner, the preset position is a destination header option of the data packet.

[0130] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The communication interface 902 is used for communication between the above electronic device and other devices. The memory may include a random access memory (RAM) and may also include a non-volatile memory (NVM), such as at least one disk storage. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0131] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (Network Processor, NP), etc.; it can also be a digital signal processing processor (Digital Signal Processing, DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0132] Embodiment 8:

[0133] On the basis of the above embodiments, an embodiment of the present invention further provides a computer-readable storage medium, in which a computer program executable by a processor is stored. When the program runs on the processor, the processor implements the following steps when executing:

[0134] Receive a first data packet sent by a data sender, and obtain first service data included in the first data packet;

[0135] Generate a first PQC signature value of the first service data based on a preconfigured first PQC signature algorithm and the first service data;

[0136] The first PQC signature value is added to a preset position of the first data packet to obtain a second data packet, and the second data packet is sent to an electronic device of a data recipient so that the electronic device of the data recipient performs a signature verification operation based on information included in the second data packet.

[0137] In a possible implementation, after acquiring the first service data included in the first data packet, and before generating a first PQC signature value of the first service data based on a preconfigured first PQC signature algorithm and the first service data, the method further includes:

[0138] The first business data is hashed based on a preset hash algorithm to obtain a hash value, and the acquired first business data is updated using the hash value.

[0139] In a possible implementation manner, adding the first PQC signature value to a preset position of the first data packet to obtain a second data packet includes:

[0140] The first PQC signature value and the first algorithm identification information of the hash algorithm are added to a preset position of the first data packet to obtain a second data packet.

[0141] In a possible implementation, the method further includes:

[0142] If a third data packet sent by another electronic device is received, and the third data packet includes a second PQC signature value, the second service data in the third data packet is obtained, and the second PQC signature value is identified at the preset position of the third data packet;

[0143] Performing a signature verification operation based on a pre-configured second PQC signature algorithm, a public key, the second PQC signature value, and the second service data to determine whether the third data packet has been attacked, wherein the public key is a public key corresponding to a private key used to generate the second PQC signature;

[0144] If yes, the third data packet is intercepted.

[0145] In a possible implementation, if the third data packet includes second algorithm identification information of a hash algorithm, after identifying the second PQC signature value at the preset position of the third data packet, and before performing a signature verification operation based on a preconfigured second PQC signature algorithm, a public key, the second PQC signature value, and the second business data, the method further includes:

[0146] The second business data is hashed based on the hash algorithm corresponding to the second algorithm information to obtain a hash value, and the second business data is updated using the hash value.

[0147] In a possible implementation manner, the preset position is a destination header option of the data packet.

[0148] Since the principle of solving the problem by the above-mentioned computer-readable storage medium is similar to that of the data security transmission method, the implementation of the above-mentioned computer-readable storage medium can refer to the embodiment of the method, and the repeated parts will not be repeated.

[0149] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0150] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0151] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0152] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0153] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data security transmission method, characterized in that: The method comprises: Receive a first data packet sent by a data sender, and obtain first service data included in the first data packet; Generate a first PQC signature value of the first service data based on a preconfigured first PQC signature algorithm and the first service data; The first PQC signature value is added to a preset position of the first data packet to obtain a second data packet, and the second data packet is sent to an electronic device of a data recipient so that the electronic device of the data recipient performs a signature verification operation based on information included in the second data packet.

2. The method according to claim 1, characterized in that After acquiring the first service data included in the first data packet, and before generating a first PQC signature value of the first service data based on a preconfigured first PQC signature algorithm and the first service data, the method further includes: The first business data is hashed based on a preset hash algorithm to obtain a hash value, and the acquired first business data is updated using the hash value.

3. The method according to claim 2, characterized in that The step of adding the first PQC signature value to a preset position of the first data packet to obtain a second data packet includes: The first PQC signature value and the first algorithm identification information of the hash algorithm are added to a preset position of the first data packet to obtain a second data packet.

4. The method according to claim 1, characterized in that: The method further comprises: If a third data packet sent by another electronic device is received, and the third data packet includes a second PQC signature value, the second service data in the third data packet is obtained, and the second PQC signature value is identified at the preset position of the third data packet; Performing a signature verification operation based on a pre-configured second PQC signature algorithm, a public key, the second PQC signature value, and the second service data to determine whether the third data packet has been attacked, wherein the public key is a public key corresponding to a private key used to generate the second PQC signature; If yes, the third data packet is intercepted.

5. The method according to claim 4, characterized in that If the third data packet includes second algorithm identification information of the hash algorithm, after identifying the second PQC signature value at the preset position of the third data packet, and before performing the signature verification operation based on the preconfigured second PQC signature algorithm, the public key, the second PQC signature value and the second business data, the method further includes: The second business data is hashed based on the hash algorithm corresponding to the second algorithm information to obtain a hash value, and the second business data is updated using the hash value.

6. The method according to any one of claims 1, 3 and 4, characterized in that: The preset position is the destination header option of the data packet.

7. A data security transmission device, characterized in that: The device comprises: A receiving and obtaining module, configured to receive a first data packet sent by a data sender, and obtain first service data included in the first data packet; A signature module, configured to generate a first PQC signature value of the first service data based on a preconfigured first PQC signature algorithm and the first service data; A generating module, configured to add the first PQC signature value to a preset position of the first data packet to obtain a second data packet; The sending module is used to send the second data packet to the electronic device of the data recipient, so that the electronic device of the data recipient performs a signature verification operation based on the information included in the second data packet.

8. The device according to claim 7, characterized in that The receiving and obtaining module is further configured to obtain the second service data in the third data packet and identify the second PQC signature value at the preset position of the third data packet if a third data packet sent by another electronic device is received and the third data packet includes the second PQC signature value; a signature verification module, configured to perform a signature verification operation based on a pre-configured second PQC signature algorithm, a public key, the second PQC signature value, and the second service data to determine whether the third data packet has been attacked, wherein the public key is a public key corresponding to a private key used when generating the second PQC signature; The processing module is used to intercept the third data packet if it is determined that the third data packet is attacked.

9. An electronic device, characterized in that: The electronic device comprises a processor, and the processor is used to implement the steps of the data security transmission method as claimed in any one of claims 1 to 6 when executing a computer program stored in a memory.

10. A computer-readable storage medium, characterized in that: It stores a computer program, which, when executed by a processor, implements the steps of the data security transmission method as described in any one of claims 1 to 6.

Images