Communication data encryption method, device and system

Abstract

The invention provides a communication data encryption method, which comprises the following steps that: when a first device receives a network access request sent by a second device, the first device generates a network access message, and the network access message comprises a network access key and a network access verification field; when the second equipment receives the network access message, the first equipment and the second equipment establish data communication connection; when the sender sends an interaction message to the receiver, the sender generates a new password, and adds the new password and the network access verification field into the interaction message to form a message data packet; the sender encrypts the message data packet with the latest first key, generates a message ciphertext and sends the message ciphertext to the receiver; the receiver receives the message ciphertext and selects the latest second key from the second password pool to decrypt the message ciphertext to obtain a decrypted message; the receiver verifies whether the decryption message is accurate or not; and when the receiver judges that the decrypted message is accurate, obtaining the interactive message from the decrypted message. In addition, the invention also provides a communication data encryption device and system.

Description

Technical Field

[0001] The present application relates to the field of data encryption technology, and in particular to a communication data encryption method, device and system. Background Art

[0002] In the field of wireless device control, since wireless control packets are broadcast in the air, it is impossible to prevent others from capturing the original signal by setting up signal receivers of the same wireless standard in the vicinity. Therefore, it is very important to encrypt the transmitted data to prevent malicious packet capture or forged control packets. In order to encrypt communication data, the encryption methods currently used mainly include symmetric encryption.

[0003] Symmetric encryption is a method of encrypting data using an algorithm that is difficult to crack, such as AES128, after the two parties have agreed on a key. The algorithm used in symmetric encryption, such as AES, is fast in encryption and decryption, and is very difficult to crack, but it has a fatal problem, which is the management of the initial key. Once the initial key is known to others or the transmission process is intercepted, the entire encryption will become invalid. In modern enterprises, personnel turnover is frequent, and it is impossible to prevent the preset keys in the code from being spread. The key transmission process can be intercepted by anyone who does not need to access corporate secrets. In order to prevent the key from being spread, communication protocols such as Zigbee have added a communication key. In order to prevent the communication key from being intercepted, a password refresh mechanism is required. However, these refresh mechanisms all have a problem. In order to ensure the accuracy of the refresh, they all require a lot of message confirmation processes, which consumes a lot of resources, resulting in the use of periodic refresh. If there is a problem with the password during the period, it cannot be discovered in time. Summary of the invention

[0004] The present application provides a communication data encryption method, device and system.

[0005] In a first aspect, an embodiment of the present application provides a method for encrypting communication data, the method for encrypting communication data comprising:

[0006] When the first device receives the network access request sent by the second device, the first device generates a network access message, where the network access message includes a network access key and a network access verification field;

[0007] When the second device receives the network access message, the first device and the second device establish a data communication connection;

[0008] When a sender sends an interactive message to a receiver, the sender generates a new password, and adds the new password and the network access verification field to the interactive message to form a message data packet, wherein the sender is one of the first device and the second device; and the receiver is the other of the first device and the second device;

[0009] The sender encrypts the message data packet with the latest first key to generate a message ciphertext and sends it to the receiver, wherein the latest first key is a key stored in a first password pool, and the first password pool includes the network access key;

[0010] The sender updates the new password to the first password pool so that the new password becomes the latest first key;

[0011] The receiving party receives the message ciphertext, selects the latest second key from the second cipher pool to decrypt the message ciphertext to obtain a decrypted message, and the second cipher pool includes the network access key;

[0012] The receiving party verifies whether the decrypted message is accurate;

[0013] When the receiving party determines that the decrypted message is accurate, the interactive message is obtained from the decrypted message, and the new password is updated from the decrypted message into the second password pool as the latest second key.

[0014] In a second aspect, an embodiment of the present application provides a communication data encryption device, wherein the communication data encryption protection device comprises:

[0015] A network access request module, when the first device receives the network access request sent by the second device, the first device generates a network access message, the network access message includes a network access key and a network access verification field;

[0016] A connection establishment module, when the second device receives the network access message, the first device and the second device establish a data communication connection;

[0017] a sending module, wherein when a sender sends an interactive message to a receiver, the sender generates a new password and adds the new password and the network access verification field to the interactive message to form a message data packet, wherein the sender is one of the first device and the second device; and the receiver is the other of the first device and the second device;

[0018] An encryption module, wherein the sender encrypts the message data packet with the latest first key to generate a message ciphertext and sends it to the receiver, wherein the latest first key is a key stored in a first password pool, and the first password pool includes the network access key;

[0019] An updating module, wherein the sender updates the new password to the first password pool so that the new password becomes the latest first key;

[0020] A decryption module, wherein the receiver receives the message ciphertext and selects the latest second key from a second cipher pool to decrypt the message ciphertext to obtain a decrypted message, wherein the second cipher pool includes the network access key;

[0021] A verification module, wherein the receiving party verifies whether the decrypted message is accurate;

[0022] The acquisition module obtains the interactive message from the decrypted message when the receiving party determines that the decrypted message is accurate, and updates the new password from the decrypted message into the second password pool as the latest second key.

[0023] In a third aspect, an embodiment of the present application provides a communication data encryption system, the communication data encryption system comprising a main system and a communication data encryption device connected to the main system, the communication data encryption device comprising:

[0024] a memory for storing a computer program; and

[0025] A processor is used to execute the computer executable program to implement the communication data encryption method.

[0026] The above-mentioned communication data encryption method, device and system realizes encryption of communication data by directly sending a message data packet carrying a new password and a network access verification field to the receiver during information interaction of the wireless communication device, and using the latest first key to encrypt the message data packet to generate a message ciphertext and send it to the receiver. Since the bytes of device communication messages are usually relatively small, and wireless communication has a minimum MTU number of bytes to send, compared to using a special password update interaction process to update the password, directly carrying the new password and the network access verification field in the device message does not increase the communication burden. It is possible to continuously update the password to minimize the password update window period and protect the security of communication. In addition, the number of passwords stored in the password pool is limited, because the password will be refreshed for each message. When an illegal device successfully forges a message, it will immediately cause the original normal device to be unable to communicate. Users can discover problems in time to avoid unpredictable harm caused by illegal devices forging messages. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying any creative work.

[0028] Figure 1A flow chart of a communication data encryption method provided in an embodiment of the present application.

[0029] Figure 2 A flowchart of the sub-steps of the communication data encryption method provided in an embodiment of the present application.

[0030] Figure 3 A flowchart of the sub-steps of the communication data encryption method provided in an embodiment of the present application.

[0031] Figure 4 A schematic diagram of a communication data encryption device provided in an embodiment of the present application.

[0032] Figure 5 A schematic diagram of the structure of a communication data encryption system provided in an embodiment of the present application.

[0033] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0035] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar planning objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate. In other words, the described embodiments are implemented according to an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any of their variations may also include other content. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to only those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0036] It should be noted that the descriptions involving "first", "second", etc. in this application are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in this field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0037] Please see Figure 1 , Figure 1 A schematic flow chart of a communication data encryption method provided in an embodiment of the present application. The communication data encryption method disclosed in an embodiment of the present application includes the following steps S100-S800.

[0038] Step S100, when the first device receives the network access request sent by the second device, the first device generates a network access message, and the network access message includes a network access key and a network access verification field. In this embodiment, before the first device and the second device exchange information, the second device needs to send a network access request to the first device, so that the first device and the second device establish a communication data transmission relationship.

[0039] First, the first device sends a network access message to the second device according to a preset transmission format. The preset transmission format is agreed upon and complied with by the first device and the second device. The message transmission format of wireless communication devices varies, depending on the device type, application scenario, and the communication standards and protocols adopted. Optionally, when transmitting text data, wireless communication devices usually use serial communication; for the transmission of image data, wireless communication devices may use analog communication or digital communication. The transmission of audio data and video data usually adopts digital communication. In addition to the above-mentioned common text, image, audio and video data formats, wireless communication devices may also transmit other types of data, such as sensor data, control instructions, etc. The message transmission format of wireless communication devices is also affected by communication protocols and standards. Different communication protocols and standards specify requirements for the format, rate, error detection and correction mechanism of data transmission. For example, wireless communication technologies such as Wi-Fi, Bluetooth, and Zigbee have their own data transmission formats and protocol specifications.

[0040] In this embodiment, during the communication information exchange process of the first device or the second device, the message header carries two fields by default, namely the new password and the verification field. When the first device sends a network access message, the first device generates a network access key and a network access verification field. The first device holds the first password pool, and the second device holds the second password pool. The network access key is stored in the first password pool of the first device.

[0041] Step S200, when the second device receives the network access message, the first device and the second device establish a data communication connection. Since the communication data transmission format of the second device is consistent with that of the first device, the second device can receive the network access message sent to it by the first device, and at the same time receive the network access key and network access verification field carried in the network access message, and update the network access verification field and store it in the second device, and store the network access key in the second password pool of the second device. When the second device receives the network access message, it indicates that the second device has completed the network access request to the first device, and the first device and the second device have established a connection relationship for transmitting data. Subsequently, the first device can directly transmit communication data to the second device, or the second device can directly transmit communication data to the first device.

[0042] Step S300, when the sender sends an interactive message to the receiver, the sender generates a new password, and adds the new password and the network access verification field to the interactive message to form a message data packet, wherein the sender is one of the first device and the second device; the receiver is the other of the first device and the second device. At this time, the first password pool is held by the sender, and the second password pool is held by the receiver. In order to avoid unlimited growth of the first password pool and the second password pool, the number of passwords in the first password pool and the second password pool are both preset numbers, and are updated using a first-in-first-out strategy. Referring to the above-mentioned step of the sender sending a network access message to the receiver, when the sender sends an interactive message to the receiver, the sender randomly generates a new password, and packages the new password, the network access verification field and the interactive message into a message data packet and sends it to the receiver.

[0043] Step S400, the sender encrypts the message data packet with the latest first key to generate a message ciphertext and sends it to the receiver, the latest first key is a key stored in the first password pool, and the first password pool includes the network access key. In this embodiment, when the sender sends a network access message to the receiver, the receiver receives the network access message, and the receiver and the sender establish a data communication connection. The sender sends the first interactive message to the receiver, and then uses the network access key in the sender's first password pool to encrypt the first interactive message. At this time, the network access key is the latest first key in the first password pool. That is, the sender encrypts the message data packet formed by the interactive message, the new password and the network access verification field with the latest first key and sends it to the receiver in a preset transmission data format. When the sender sends the second message ciphertext, the third message ciphertext and subsequent message ciphertexts to the receiver, the sender selects the latest first key in the first password pool to encrypt the message data packet, and obtains the message ciphertext after encryption. It should be noted that in order to avoid generating a large number of new passwords when message communication is unreachable, the sender does not generate a new password before the receiver receives the interactive message from the sender, and the sender uses the latest first key in the first password pool.

[0044] Step S500, the sender updates the new password to the first password pool so that the new password becomes the latest first key. In this embodiment, after the sender sends the message ciphertext, the sender updates the randomly generated new password and stores it in the first password pool. After the new password is stored in the first password pool, it becomes the latest first key. When the sender and the sender transmit data subsequently, the new password can be used as the latest first key to encrypt the message data packet sent by them.

[0045] Step S600, the receiving party receives the message ciphertext, selects the latest second key from the second password pool to decrypt the message ciphertext to obtain a decrypted message, and the second password pool includes the network access key. In this embodiment, after the sender sends the first message ciphertext to the receiving party, the receiving party receives the message ciphertext and decrypts and verifies the message ciphertext. Specifically, since the receiving party's password pool stores the network access key when receiving the network access message, the receiving party selects the network access key in the second password pool to decrypt the message ciphertext to obtain a decrypted message. The receiving party then performs the next step of verification on the decrypted message. After the sender sends the second message ciphertext, the third message ciphertext and subsequent message ciphertexts to the receiving party, the receiving party selects the latest second key in the second password pool to decrypt the message ciphertext, and then performs the next step of verification after decryption.

[0046] Step S700: The receiving party verifies whether the decrypted message is accurate. Figures 2 to 3 , Figure 2 and Figure 3A flowchart of the sub-steps of the encryption method for communication data provided in the embodiment of the present application. The receiving party verifies whether the decrypted message is accurate, that is, determines whether the network access verification field is correct, and determines whether the network access verification field in the receiving party is the same as the network access verification field in the decrypted message.

[0047] Step S800, when the receiving party determines that the decrypted message is accurate, the interactive message is obtained from the decrypted message, and the new password is updated from the decrypted message into the second password pool as the latest second key. When the receiving party decrypts the interactive message and verifies that the network access verification field in the second device is the same as the network access verification field in the decrypted message, the receiving party can directly obtain the interactive message data in the message ciphertext and obtain the transmission data required by the receiving party. After obtaining the data of the interactive message, the receiving party updates the new password in the message data packet and stores it in the second password pool. After the new password is stored, it becomes the latest second key. The latest second key is used to encrypt the interactive message when the receiving party sends the interactive message to the sender.

[0048] Step S900: When the receiving party determines that the verification field is inaccurate, the receiving party selects another key from the second password pool to decrypt the message ciphertext. That is, when the receiving party decrypts the interactive message and verifies that the network access verification field in the second device is different from the network access verification field in the decrypted message, another key is selected to decrypt and verify the message ciphertext.

[0049] When the receiving party selects another key from the second password pool to decrypt the message ciphertext and determines that the verification field is accurate, it indicates that the sending party and the receiving party have successfully communicated. For specific details, please refer to the detailed description in step S800.

[0050] When the verification field is still inaccurate after all the latest second keys in the second password pool of the receiver are used for decryption, the communication between the sender and the receiver fails and the network access process needs to be repeated. That is, the receiver needs to resend the network access request message to the receiver, that is, re-do the process steps of sending the handover message from step S100 above.

[0051] In the above-mentioned communication data encryption method, during the information interaction of the wireless communication device, the sender encrypts the message data packet with the latest first key, and the receiver decrypts and verifies the message ciphertext with the latest second key after receiving it, and obtains the interactive message data after the decryption and verification are successful. The communication data encryption method of the present application effectively prevents malicious packet capture or forged control packets by other devices during the communication process of the wireless device, and while encrypting the communication data, the second device can quickly obtain the interactive message through decryption verification, which effectively improves the efficiency of data transmission of the wireless communication device, strengthens the confidentiality of data transmission and improves the user experience.

[0052] Please see Figure 4 , Figure 4 A schematic diagram of a communication data encryption device provided in an embodiment of the present application. The present application also provides a communication data encryption device 10. The communication data encryption device 10 includes a network access request module 110, a connection establishment module 120, a sending module 130, an encryption module 140, an update module 150, a decryption module 160, a verification module 170, and an acquisition module 180.

[0053] The network access request module 110, when the first device receives the network access request sent by the second device, the first device generates a network access message, and the network access message includes a network access key and a network access verification field. In this embodiment, before the first device and the second device exchange information, the second device needs to send a network access request to the first device, so that the first device and the second device establish a communication data transmission relationship.

[0054] First, the first device sends a network access message to the second device according to a preset transmission format. The preset transmission format is agreed upon and complied with by the first device and the second device. The message transmission format of wireless communication devices varies, depending on the device type, application scenario, and the communication standards and protocols adopted. Optionally, when transmitting text data, wireless communication devices usually use serial communication; for the transmission of image data, wireless communication devices may use analog communication or digital communication. The transmission of audio data and video data usually adopts digital communication. In addition to the above-mentioned common text, image, audio and video data formats, wireless communication devices may also transmit other types of data, such as sensor data, control instructions, etc. The message transmission format of wireless communication devices is also affected by communication protocols and standards. Different communication protocols and standards specify requirements for the format, rate, error detection and correction mechanism of data transmission. For example, wireless communication technologies such as Wi-Fi, Bluetooth, and Zigbee have their own data transmission formats and protocol specifications.

[0055] In this embodiment, during the communication information exchange process of the first device or the second device, the message header carries two fields by default, namely the new password and the verification field. When the first device sends a network access message, the first device generates a network access key and a network access verification field. The first device holds the first password pool, and the second device holds the second password pool. The network access key is stored in the first password pool of the first device.

[0056] Establish a connection module 120, when the second device receives the network access message, the first device and the second device establish a data communication connection. Since the communication data transmission format of the second device is consistent with that of the first device, the second device can receive the network access message sent to it by the first device, and at the same time receive the network access key and network access verification field carried by the network access message, and update the network access verification field and store it in the second device, and store the network access key in the second password pool of the second device. When the second device receives the network access message, it indicates that the second device has completed the network access request to the first device, and the first device and the second device have established a connection relationship for transmitting data. Subsequently, the first device can directly transmit communication data to the second device, or the second device can directly transmit communication data to the first device.

[0057] Sending module 130, when the sender sends an interactive message to the receiver, the sender generates a new password, and adds the new password and the network access verification field to the interactive message to form a message data packet, wherein the sender is one of the first device and the second device; the receiver is the other of the first device and the second device. At this time, the first password pool is held by the sender, and the second password pool is held by the receiver. In order to avoid unlimited growth of the first password pool and the second password pool, the number of passwords in the first password pool and the second password pool are both preset numbers, and are updated using a first-in-first-out strategy. Referring to the above-mentioned step of the sender sending a network access message to the receiver, when the sender sends an interactive message to the receiver, the sender randomly generates a new password, and packages the new password, the network access verification field and the interactive message into a message data packet and sends it to the receiver.

[0058] Encryption module 140, the sender encrypts the message data packet with the latest first key to generate a message ciphertext and sends it to the receiver, the latest first key is a key stored in the first password pool, and the first password pool includes the network access key. In this embodiment, when the sender sends a network access message to the receiver, the receiver receives the network access message, and the receiver and the sender establish a data communication connection. The sender sends the first interactive message to the receiver, and then uses the network access key in the sender's first password pool to encrypt the first interactive message. At this time, the network access key is the latest first key in the first password pool. That is, the sender encrypts the message data packet formed by the interactive message, the new password, and the network access verification field with the latest first key and sends it to the receiver in a preset transmission data format. When the sender sends the second message ciphertext, the third message ciphertext, and the subsequent message ciphertext to the receiver, the sender selects the latest first key in the first password pool to encrypt the message data packet, and obtains the message ciphertext after encryption. It should be noted that in order to avoid generating a large number of new passwords when message communication is unreachable, the sender does not generate a new password before the receiver receives the interactive message from the sender, and the sender uses the latest first key in the first password pool.

[0059] In the updating module 150, the sender updates the new password to the first password pool so that the new password becomes the latest first key. In this embodiment, after the sender sends the message ciphertext, the sender updates the randomly generated new password and stores it in the first password pool. After the new password is stored in the first password pool, it becomes the latest first key. When the sender and the sender transmit data subsequently, the new password can be used as the latest first key to encrypt the message data packet sent by them.

[0060] Decryption module 160, the receiver receives the message ciphertext, selects the latest second key from the second password pool to decrypt the message ciphertext to obtain a decrypted message, and the second password pool includes the network access key. In this embodiment, after the sender sends the first message ciphertext to the receiver, the receiver receives the message ciphertext and decrypts and verifies the message ciphertext. Specifically, since the network access key when receiving the network access message is stored in the receiver's password pool, the receiver selects the network access key in the second password pool to decrypt the message ciphertext to obtain a decrypted message. Then the receiver performs the next step of verification on the decrypted message. After the sender sends the second message ciphertext, the third message ciphertext and subsequent message ciphertexts to the receiver, the receiver selects the latest second key in the second password pool to decrypt the message ciphertext, and then performs the next step of verification after decryption.

[0061] Verification module 170, the receiving party verifies whether the decrypted message is accurate. Figures 2 to 3 , Figure 2 and Figure 3 A flowchart of the sub-steps of the encryption method for communication data provided in the embodiment of the present application. The receiving party verifies whether the decrypted message is accurate, that is, determines whether the network access verification field is correct, and determines whether the network access verification field in the second device is the same as the network access verification field in the decrypted message.

[0062] Acquisition module 180, when the receiving party determines that the decrypted message is accurate, obtains the interactive message from the decrypted message, and updates the new password from the decrypted message into the second password pool as the latest second key. When the receiving party decrypts the interactive message and verifies that the network access verification field in the second device is the same as the network access verification field in the decrypted message, the receiving party can directly obtain the interactive message data in the message ciphertext and obtain the transmission data required by the receiving party. After obtaining the data of the interactive message, the receiving party updates the new password in the message data packet and stores it in the second password pool. After the new password is stored, it becomes the latest second key. The latest second key is used to encrypt the interactive message when the receiving party sends the interactive message to the sender.

[0063] Please refer to Figure 5 , Figure 5 A schematic diagram of a communication data encryption system structure provided in an embodiment of the present application. The present application also provides a communication data encryption system 1, the communication data encryption system comprising a main system 20 and a communication data encryption device 10 connected to the main system for communication, the communication data encryption device 10 comprising a memory 801 for storing a computer program; and a processor 802 for executing the computer executable program to implement the communication data encryption method.

[0064] In some embodiments, the processor 801 may be a central processing unit (CPU), a microcontroller, a microprocessor or other data processing chip, and is used to execute control program instructions stored in the memory 802 .

[0065] The memory 802 includes at least one type of readable storage medium, which includes a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory, etc.), a magnetic memory, a disk, an optical disk, etc. The memory 802 may be an internal storage unit of a computer device in some embodiments, such as a hard disk of a computer device. The memory 802 may also be a storage device of an external computer device in other embodiments, such as a plug-in hard disk equipped on a computer device, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), etc. Further, the memory 802 may also include both an internal storage unit of a computer device and an external storage device. The memory 802 may not only be used to store application software and various types of data installed in a computer device, such as codes for realizing intelligent lifting processing, but may also be used to temporarily store data that has been output or is to be output.

[0066] The above-mentioned communication data encryption method, device and system realizes encryption of communication data by directly sending a message data packet carrying a new password and a network access verification field to the receiver during information interaction of the wireless communication device, and using the latest first key to encrypt the message data packet to generate a message ciphertext and send it to the receiver. Since the bytes of device communication messages are usually relatively small, and wireless communication has a minimum MTU number of bytes to send, compared to using a special password update interaction process to update the password, directly carrying the new password and the network access verification field in the device message does not increase the communication burden. It is possible to continuously update the password to minimize the password update window period and protect the security of communication. In addition, the number of passwords stored in the password pool is limited, because the password will be refreshed for each message. When an illegal device successfully forges a message, it will immediately cause the original normal device to be unable to communicate. Users can discover problems in time to avoid unpredictable harm caused by illegal devices forging messages.

[0067] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

[0068] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0069] The above examples are only preferred embodiments of the present application, and certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application still fall within the scope covered by the present application.

Claims

1. A communication data encryption method, characterized in that: The encryption method of the communication data includes: When the first device receives the network access request sent by the second device, the first device generates a network access message, where the network access message includes a network access key and a network access verification field; When the second device receives the network access message, the first device and the second device establish a data communication connection; When a sender sends an interactive message to a receiver, the sender generates a new password, and adds the new password and the network access verification field to the interactive message to form a message data packet, wherein the sender is one of the first device and the second device; and the receiver is the other of the first device and the second device; The sender encrypts the message data packet with the latest first key to generate a message ciphertext and sends it to the receiver, wherein the latest first key is a key stored in a first password pool, and the first password pool includes the network access key; The sender updates the new password to the first password pool so that the new password becomes the latest first key; The receiving party receives the message ciphertext, selects the latest second key from the second cipher pool to decrypt the message ciphertext to obtain a decrypted message, and the second cipher pool includes the network access key; The receiving party verifies whether the decrypted message is accurate; When the receiving party determines that the decrypted message is accurate, the interactive message is obtained from the decrypted message, and the new password is updated from the decrypted message into the second password pool as the latest second key.

2. The method for encrypting communication data according to claim 1, characterized in that: The first password pool is held by the sender, and the second password pool is held by the receiver.

3. The method for encrypting communication data according to claim 2, wherein: The number of passwords in the first password pool and the second password pool is a preset number.

4. The method for encrypting communication data according to claim 1, wherein: The receiving party verifies whether the decrypted message is accurate, including: Determine whether the verification field in the receiver is the same as the network access verification field.

5. The method for encrypting communication data according to claim 4, characterized in that: The communication data encryption method also includes: When the receiving party determines that the network access verification field is inaccurate, the receiving party selects another key from the second cryptographic pool to decrypt the message ciphertext until all the keys in the second cryptographic pool are used for decryption, and if the verification field is still inaccurate, the communication between the sending party and the receiving party fails, and the network access process needs to be repeated; or When the receiving party determines that the network access verification field is inaccurate, the receiving party selects another key from the second password pool to decrypt the message ciphertext and determines that the verification field is accurate, the sending party successfully communicates with the receiving party.

6. The method for encrypting communication data according to claim 1, wherein: Before the receiving party obtains the interactive message from the sending party, the sending party does not generate a new password, and the sending party uses the latest first secret key in the first password pool.

7. A communication data encryption device, characterized in that: The communication data encryption protection device comprises: A network access request module, when the first device receives the network access request sent by the second device, the first device generates a network access message, the network access message includes a network access key and a network access verification field; A connection establishment module, when the second device receives the network access message, the first device and the second device establish a data communication connection; a sending module, wherein when a sender sends an interactive message to a receiver, the sender generates a new password and adds the new password and the network access verification field to the interactive message to form a message data packet, wherein the sender is one of the first device and the second device; and the receiver is the other of the first device and the second device; An encryption module, wherein the sender encrypts the message data packet with the latest first key to generate a message ciphertext and sends it to the receiver, wherein the latest first key is a key stored in a first password pool, and the first password pool includes the network access key; An updating module, wherein the sender updates the new password to the first password pool so that the new password becomes the latest first key; A decryption module, wherein the receiver receives the message ciphertext and selects the latest second key from a second cipher pool to decrypt the message ciphertext to obtain a decrypted message, wherein the second cipher pool includes the network access key; A verification module, wherein the receiving party verifies whether the decrypted message is accurate; The acquisition module obtains the interactive message from the decrypted message when the receiving party determines that the decrypted message is accurate, and updates the new password from the decrypted message into the second password pool as the latest second key.

8. The communication data encryption device according to claim 7, characterized in that: The first password pool is held by the sender, and the second password pool is held by the receiver.

9. The communication data encryption device according to claim 7, characterized in that: The number of passwords in the first password pool and the second password pool are both preset numbers.

10. A communication data encryption system, comprising a main system and a communication data encryption device connected to the main system, characterized in that: The encryption device for communication data includes: a memory for storing a computer program; and A processor, configured to execute the computer executable program to implement the communication data encryption method as described in any one of claims 1 to 7.

Images