Transmission data encryption and decryption method and device, equipment, medium and product

Abstract

The invention discloses a transmission data encryption and decryption method and device, equipment, a medium and a product, and relates to the technical field of information security, and the method comprises the steps: selecting a first target security integer from candidate security integers as a first master key value, and generating a first key sharing value according to the first master key value; determining an encryption key value according to a second key sharing value and the first key sharing value sent by the data receiving end, and encrypting the original transmission data by using the encryption key value to generate encrypted transmission data; wherein the second key sharing value is generated according to a second target security integer selected from the candidate security integers by the data receiving end; and sending the encrypted transmission data and the first key sharing value to a data receiving end, so that the data receiving end decrypts the encrypted transmission data according to the first key sharing value to obtain the original transmission data. According to the invention, the security of the secret key is ensured, and the security of encrypted transmission data is further ensured.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method, device, equipment, medium and product for encrypting and decrypting transmitted data. Background Art

[0002] With the rapid development of Internet technology, there are more and more businesses that require data transmission, and the data transmission method has evolved from paper transmission to electronic transmission, which has undoubtedly greatly improved the convenience of data transmission. However, with the rise of electronic transmission, malicious attacks on transmitted data have gradually become rampant, so it is necessary to encrypt the transmitted data.

[0003] In traditional data encryption methods, keys are usually generated by a single user end, which makes it easy for the keys to be leaked when the user end is attacked maliciously, affecting the security of data encryption transmission. Summary of the invention

[0004] The present invention provides a method, device, equipment, medium and product for encrypting and decrypting transmitted data to solve the problem that the prior art relies on a single user end to generate a key, resulting in poor security of encrypted data transmission.

[0005] According to one aspect of the present invention, there is provided a method for encrypting transmitted data, which is executed by a data sending end and comprises:

[0006] Selecting a first target security integer from the candidate security integers as a first master key value, and generating a first key sharing value according to the first master key value;

[0007] Determine an encryption key value according to a second key sharing value sent by a data receiving end and the first key sharing value, and use the encryption key value to encrypt the original transmission data to generate encrypted transmission data; wherein the second key sharing value is generated according to a second target security integer selected by the data receiving end from the candidate security integers;

[0008] The encrypted transmission data and the first key sharing value are sent to the data receiving end, so that the data receiving end can decrypt the encrypted transmission data according to the first key sharing value to obtain the original transmission data.

[0009] According to another aspect of the present invention, a method for decrypting transmitted data is provided, which is executed by a data receiving end and includes:

[0010] Selecting a second target secure integer from the candidate secure integers as a second master key value, and generating a second key sharing value according to the second master key value;

[0011] Acquire the encrypted transmission data and the first key sharing value sent by the data sending end, and determine the decryption key value according to the first key sharing value and the second key sharing value; wherein the first key sharing value is generated according to the first target security integer selected by the data sending end from the candidate security integers, and the encrypted transmission data is generated by the encryption method of the transmission data as described in any one of the present inventions;

[0012] The encrypted transmission data is decrypted using the decryption key value to obtain the original transmission data.

[0013] According to another aspect of the present invention, there is provided a device for encrypting transmitted data, which is configured at a data transmitting end and comprises:

[0014] A first key sharing value generating module, configured to select a first target security integer from candidate security integers as a first master key value, and generate a first key sharing value according to the first master key value;

[0015] an encrypted transmission data generating module, configured to determine an encryption key value according to a second key sharing value sent by a data receiving end and the first key sharing value, and to encrypt the original transmission data using the encryption key value to generate encrypted transmission data; wherein the second key sharing value is generated according to a second target security integer selected by the data receiving end from the candidate security integers;

[0016] The encrypted transmission data sending module is used to send the encrypted transmission data and the first key sharing value to the data receiving end, so that the data receiving end can decrypt the encrypted transmission data according to the first key sharing value to obtain the original transmission data.

[0017] According to another aspect of the present invention, there is provided a transmission data decryption device, which is configured at a data receiving end and includes:

[0018] A second key sharing value generating module, configured to select a second target security integer from the candidate security integers as a second master key value, and generate a second key sharing value according to the second master key value;

[0019] a decryption key value determination module, configured to obtain the encrypted transmission data and a first key sharing value sent by the data sending end, and determine the decryption key value according to the first key sharing value and the second key sharing value; wherein the first key sharing value is generated according to a first target security integer selected by the data sending end from the candidate security integers, and the encrypted transmission data is generated by using the transmission data encryption method as described in any one of the present inventions;

[0020] The data decryption module is used to decrypt the encrypted transmission data using the decryption key value to obtain the original transmission data.

[0021] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0022] at least one processor; and

[0023] a memory communicatively connected to the at least one processor; wherein,

[0024] The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor so that the at least one processor can perform any method described in the present invention.

[0025] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement any method of the present invention when executed.

[0026] According to another aspect of the present invention, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any one of the methods according to the present invention.

[0027] The present invention selects a first target security integer from candidate security integers as a first master key value, and generates a first key sharing value according to the first master key value; determines an encryption key value according to a second key sharing value and a first key sharing value sent by a data receiving end, and uses the encryption key value to encrypt original transmission data to generate encrypted transmission data; wherein, the second key sharing value is generated according to a second target security integer selected by the data receiving end from the candidate security integers. Since the encryption key is generated using the key sharing values ​​generated by the data sending end and the data receiving end respectively, even if either end is subjected to a malicious attack, the key sharing value of the end cannot be directly used to crack the encryption key, thereby achieving a risk sharing effect, ensuring the security of the encryption key, and further ensuring the security of the encrypted transmission data.

[0028] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 A flowchart of a method for encrypting transmitted data provided in Embodiment 1 of the present invention;

[0031] Figure 2 A flowchart of a method for encrypting transmitted data provided in Embodiment 2 of the present invention;

[0032] Figure 3 A flowchart of a method for decrypting transmitted data provided in Embodiment 3 of the present invention;

[0033] Figure 4 A schematic diagram of the structure of an encryption device for transmitting data provided in Embodiment 4 of the present invention;

[0034] Figure 5 A schematic diagram of the structure of a decryption device for transmission data provided in Embodiment 5 of the present invention;

[0035] Figure 6 It is a structural schematic diagram of an electronic device for implementing the transmission data encryption method and / or the transmission data decryption method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0036] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0037] It should be noted that the terms "target", "candidate", "first", "second", "third", "fourth", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0038] In traditional data encryption methods, keys are usually generated by a single user end, which makes it easy for the keys to be leaked when the user end is attacked maliciously, affecting the security of encrypted data transmission. For example, assuming that the encryption key is generated by the data sender, then when the data sender is attacked maliciously, the encryption key is easily leaked, allowing the attacker to easily tamper with the content of the encrypted transmission data; for another example, assuming that the decryption key is generated by the data receiver, then when the data receiver is attacked maliciously, the decryption key is easily leaked, allowing the attacker to easily crack the content of the encrypted transmission data. It can be seen that traditional data encryption methods cannot guarantee the security of the keys, which further leads to poor security of encrypted data transmission.

[0039] Embodiment 1

[0040] Figure 1 This is a flowchart of a data transmission encryption method provided in the first embodiment of the present invention. This embodiment is applicable to the case where a data transmission end generates encrypted transmission data using an encryption key and sends it to a data receiving end. This method can be executed by an encryption device for transmission data. The encryption device for transmission data is configured in the data transmission end and can be implemented in the form of hardware and / or software. The data transmission end can be any terminal with data transmission requirements, such as a smart phone, computer or server, etc. This embodiment does not impose any restrictions on the specific type of the data transmission end. Figure 1 As shown, the method includes:

[0041] S101. Select a first target security integer from candidate security integers as a first master key value, and generate a first key sharing value according to the first master key value.

[0042] The security integer refers to a set of numbers uniquely determined by the target security parameter. In this embodiment, a security integer of a preset length is preselected as a candidate security integer, for example, a security integer matching the security level of the target security parameter is selected as a candidate security integer.

[0043] In one implementation, the data sending end obtains candidate security integers, randomly selects a candidate security integer as a first target security integer, and uses the randomly selected first target security integer as the first master key value. For example, assuming that the first target security integer randomly selected by the data sending end from the candidate security integers is "2 31 ", then "2 31 " as the first master key value.

[0044] The data sending end obtains a preset key sharing value calculation function, and uses the first master key value as an independent variable of the key sharing value calculation function for function calculation, and generates a first key sharing value according to the calculation result. The key sharing value calculation function can be set according to actual business needs.

[0045] S102: Determine an encryption key value according to the second key sharing value and the first key sharing value sent by the data receiving end, and use the encryption key value to encrypt the original transmission data to generate encrypted transmission data.

[0046] The second key sharing value is generated according to the second target security integer selected by the data receiving end from the candidate security integers. The encryption key value refers to the key used to encrypt the original transmission data, and the original transmission data refers to the original data without any encryption processing, that is, the original data expected to be transmitted between the data sending end and the data receiving end.

[0047] In one embodiment, the data receiving end obtains a candidate security integer, and randomly selects a candidate security integer as a second target security integer, and uses the randomly selected second target security integer as a second master key value. The data receiving end obtains a preset key sharing value operation function, and uses the second master key value as an independent variable of the key sharing value operation function to perform a function operation, and generates a second key sharing value according to the operation result. The data receiving end uses the communication channel between the data sending end and the data sending end to send the second key sharing value to the data sending end.

[0048] The data sending end obtains the second key sharing value sent by the data receiving end, and calculates the encryption key value according to the first key sharing value generated at the data sending end and the second key sharing value generated at the data receiving end to determine the encryption key value.

[0049] Optionally, the data transmitting end performs algebraic calculation according to the first key sharing value and the second key sharing value, and determines the encryption key value according to the algebraic calculation result. The algebraic calculation may be a multiplication operation or the like.

[0050] For example, assuming that the first key sharing value is Key1 and the second key sharing value is Key2, the data sending end performs a multiplication operation on "Key1" and "Key2" and uses the multiplication result "Key1*Key2" as the encryption key value.

[0051] For another example, assuming that the first key sharing value is Second shared key value Among them, Key A and Key B The data sending end has a first master key value and a second master key value. A and Sym_keyB Perform multiplication to calculate the encryption key value

[0052] After the data sending end calculates the encryption key value, it uses the encryption key value to encrypt the original transmission data according to the preset encryption algorithm to generate encrypted transmission data.

[0053] Optionally, the data sending end uses the encryption key value to encrypt the original transmission data using a symmetric encryption algorithm to generate encrypted transmission data. For example, the encrypted transmission data C is calculated in the following manner:

[0054] C = SymEnc(m,Key);

[0055] Among them, m represents the original transmission data, Key represents the encryption key value, and SymEnc() represents the function expression corresponding to the symmetric encryption algorithm.

[0056] S103: Send the encrypted transmission data and the first key sharing value to the data receiving end, so that the data receiving end can decrypt the encrypted transmission data according to the first key sharing value to obtain the original transmission data.

[0057] In one embodiment, the data transmitting end uses the communication channel between the data receiving end and the data transmitting end to send the encrypted transmission data and the first key sharing value to the data receiving end. After the data receiving end obtains the encrypted transmission data and the first key sharing value, it uses the first key sharing value and the second key sharing value to determine the decryption key value, and decrypts the encrypted transmission data according to the decryption key value to obtain the original transmission data.

[0058] The present invention selects a first target security integer from candidate security integers as a first master key value, and generates a first key sharing value according to the first master key value; determines an encryption key value according to a second key sharing value and a first key sharing value sent by a data receiving end, and uses the encryption key value to encrypt original transmission data to generate encrypted transmission data; wherein the second key sharing value is generated according to a second target security integer selected by the data receiving end from the candidate security integers. Since the encryption key is generated using key sharing values ​​generated by the data sending end and the data receiving end respectively, even if the data sending end is subjected to a malicious attack, the attacker cannot directly use the first key sharing value of the data sending end to crack the encryption key value, thereby achieving a risk sharing effect, ensuring the security of the encryption key value, and further ensuring the security of the encrypted transmission data. For example, the attacker cannot tamper with the content of the encrypted transmission data.

[0059] Embodiment 2

[0060] Figure 2This is a flowchart of a data transmission encryption method provided by Embodiment 2 of the present invention. This embodiment further optimizes and expands the above Embodiment 1 and can be combined with the above optional implementations. Figure 2 As shown, the method includes:

[0061] S201. Select a first target security integer from candidate security integers as a first master key value.

[0062] S202: Acquire a target security parameter, and determine the target public parameter from the candidate public parameters according to an association relationship between the target security parameter and the candidate public parameters.

[0063] Among them, the security parameter is a quantitative indicator to measure the security of the system. The security parameter determines the difficulty for an attacker to break into the system using a specific method, thereby indirectly reflecting the security of the system. It is understandable that the larger the security parameter, the greater the difficulty of breaking into the system. The target security parameter is a quantitative indicator to measure the difficulty of cracking the key (encryption key and / or decryption key) in this method.

[0064] Public parameters are a set of parameters used in the encryption and decryption process to ensure that the data sender and the data receiver can correctly perform encryption and decryption operations. Public parameters usually include some fixed mathematical constants or values. Target public parameters are public parameters selected from candidate public parameters according to the target security parameters.

[0065] In one implementation, a security parameter calculation algorithm is used to calculate a target security parameter, and based on the association between the target security parameter and the candidate public parameters, the candidate public parameters that have an association with the target security parameter are used as target public parameters that meet the target security parameter.

[0066] For example, assuming that the target security parameter is λ1, and the candidate public parameter associated with the target security parameter λ1 is pp1, pp1 is used as the target public parameter that meets the target security parameter λ1.

[0067] S203: Obtain a generator of a target finite field from the target public parameters as a first public parameter, and obtain a maximum safe integer corresponding to the candidate safe integers from the target public parameters as a second public parameter.

[0068] The target finite field refers to a field containing a finite number of elements, and the generator of the target finite field refers to an element g in the target finite field. For any non-zero element b in the target finite field, if b is equal to a power of g, then this element g is called the generator of the target finite field. The maximum safe integer refers to the maximum integer among the candidate safe integers, that is, the upper bound of the candidate safe integers.

[0069] In one implementation, parameter extraction is performed on the target public parameter, a generator of the target finite field is obtained as the first public parameter, and a maximum safe integer is obtained as the second public parameter.

[0070] S204: Generate a first shared key value according to the first public parameter, the second public parameter and the first master key value.

[0071] In one implementation, a preset key value calculation function is used to calculate the key sharing value according to the first public parameter, the second public parameter and the first master key value to determine the first key sharing value.

[0072] By obtaining a target security parameter, and determining the target public parameter from the candidate public parameters according to the association relationship between the target security parameter and the candidate public parameters, obtaining a generator of a target finite field from the target public parameter as a first public parameter, and obtaining a maximum security integer corresponding to the candidate security integer from the target public parameter as a second public parameter; generating a first key sharing value according to the first public parameter, the second public parameter and the first master key value, thereby ensuring that the target public parameter complies with the security of the target security parameter and further ensuring the security of the generated first key sharing value.

[0073] Optionally, determining the first key sharing value according to the first public parameter, the second public parameter, and the first master key value includes:

[0074] The first shared key value is determined using the following formula:

[0075] Sym_key A =g KeyA modn;

[0076] Among them, Sym_key A represents the first key shared value, g represents the first public parameter, i.e., the generator of the target finite field, n represents the second public parameter, i.e., the maximum secure integer corresponding to the candidate secure integer, mod represents the modulus operation, Key A Indicates the first master key value.

[0077] The first shared key value is determined by using the following formula: Sym_key A =g KeyA modn, since the first public parameter, the second public parameter and the first master key value are used to jointly calculate the first key sharing value, the calculation complexity of the first key sharing value is increased, thereby reducing the possibility of the first key sharing value being cracked, and indirectly improving the security of the encryption key value.

[0078] S205. Determine an encryption key value according to the second key sharing value and the first key sharing value sent by the data receiving end, and use the encryption key value to encrypt the original transmission data to generate encrypted transmission data.

[0079] S206. Send the encrypted transmission data and the first key sharing value to the data receiving end, so that the data receiving end can decrypt the encrypted transmission data according to the first key sharing value to obtain the original transmission data.

[0080] Optionally, after sending the encrypted transmission data and the first key sharing value to the data receiving end, the method further includes:

[0081] 1) In response to a data decryption success signal sent by the data receiving end, a third target security integer is selected from the candidate security integers, and a first master key value fragment is determined according to a difference between the first master key value and the third target security integer.

[0082] In one embodiment, when the data receiving end successfully decrypts the original transmission data, it sends a data decryption success signal to the data sending end. In response to the data decryption success signal, the data sending end randomly selects a candidate security integer as the third target security integer again, and performs a difference operation based on the first master key value and the third target security integer to determine the first master key value fragment.

[0083] Optionally, assume that a randomly selected third target secure integer is Key A1 , the first master key value is Key A , then the first master key value is the shard key A2 =(Key A -Key A1 )modn, n is the second common parameter.

[0084] 2) Obtaining the fourth target security integer sent by the data receiving end, and updating the first master key value according to the sum of the first master key value fragment and the fourth target security integer, to generate an updated first master key value.

[0085] The fourth target security integer is selected from the candidate security integers according to the data receiving end.

[0086] In one implementation, the data receiving end randomly selects a candidate security integer as the fourth target security integer again, and sends the fourth target security integer to the data sending end. The data sending end obtains the fourth target security integer sent by the data receiving end, performs a sum operation based on the first master key value fragment and the fourth target security integer, and determines the updated first master key value based on the sum operation result.

[0087] Optionally, assume that the fourth target security integer randomly selected by the data receiving end is KeyB1 , the first master key value is sharded as Key A2 , then the updated first master key value key′ A =(Key A2 +Key B1 )modn, n is the second common parameter.

[0088] 3) Generate an updated first key sharing value according to the updated first master key value.

[0089] Optional, assuming the updated first master key value is key A ′, then the updated first key sharing value Sym_key A ′=g keyA 'modn, n is the second common parameter.

[0090] In response to a data decryption success signal sent by a data receiving end, a third target security integer is selected from candidate security integers, and a first master key value slice is determined according to a difference between the first master key value and the third target security integer; a fourth target security integer sent by the data receiving end is obtained, and the first master key value is updated according to the sum of the first master key value slice and the fourth target security integer to generate an updated first master key value; wherein the fourth target security integer is selected from the candidate security integers according to the data receiving end; an updated first key sharing value is generated according to the updated first master key value, so that the effect of timely updating the first master key value and the first key sharing value of the data sending end is achieved whenever the data receiving end successfully decrypts the data, and the effect of timely updating the encryption key value is indirectly achieved, thereby increasing the security of the encryption key value, avoiding the risk of being cracked by continuously using a fixed encryption key value for data encryption, and improving the security of encrypted data transmission.

[0091] Optionally, the method further includes:

[0092] The current time is compared with the deadline of data transmission; if the current time is the same as the deadline, the first master key value and the first key sharing value are deleted.

[0093] The data transmission deadline refers to the end time of a data transmission cycle.

[0094] In one implementation, the data transmitting end compares the current time with the deadline to determine whether the current time has reached the deadline. If the current time has not reached the deadline, that is, the current time is different from the deadline, the comparison continues; if the current time has reached the deadline, that is, the current time is the same as the deadline, indicating that a data transmission cycle has ended, the first master key value and the first key sharing value are deleted.

[0095] By comparing the current moment with the deadline for data transmission; and deleting the first master key value and the first key sharing value when the current moment is the same as the deadline, the effect of timely deleting the first master key value and the first key sharing value related to the generation of the encryption key is achieved when a data transmission cycle ends, thereby avoiding the risk of leakage of the first master key value and / or the first key sharing value, which may lead to the risk of the encryption key value being cracked, and increasing the security of the encryption key value.

[0096] Embodiment 3

[0097] Figure 3 This is a flowchart of a method for decrypting transmission data provided in the third embodiment of the present invention. This embodiment is applicable to the case where the data receiving end uses the decryption key to extract the original transmission data. The method can be executed by a transmission data decryption device, which is configured in the data receiving end and can be implemented in the form of hardware and / or software. The data receiving end can be any terminal with data receiving requirements, such as a smart phone, computer or server, etc. This embodiment does not impose any restrictions on the specific type of the data receiving end. Figure 3 As shown, the method includes:

[0098] S301. Select a second target security integer from candidate security integers as a second master key value, and generate a second key sharing value according to the second master key value.

[0099] In one embodiment, the data receiving end obtains candidate security integers, randomly selects a candidate security integer as the second target security integer, and uses the randomly selected second target security integer as the second master key value. For example, assuming that the second target security integer randomly selected by the data receiving end from the candidate security integers is "2 30 ", then "2 30 " as the second master key value.

[0100] The data receiving end obtains a preset key sharing value calculation function, and uses the second master key value as an independent variable of the key sharing value calculation function for function calculation, and generates a second key sharing value according to the calculation result. The key sharing value calculation function can be set according to actual business needs.

[0101] Optionally, generating a second key sharing value according to the second master key value includes:

[0102] Obtain a target security parameter, and determine the target public parameter from the candidate public parameters based on an association relationship between the target security parameter and the candidate public parameters; obtain a generator of a target finite field from the target public parameter as a first public parameter, and obtain a maximum security integer corresponding to the candidate security integer from the target public parameter as a second public parameter; determine a second key sharing value based on the first public parameter, the second public parameter and the second master key value.

[0103] In one embodiment, the data receiving end calculates the target security parameter using a security parameter calculation algorithm, and based on the association relationship between the target security parameter and the candidate public parameter, uses the candidate public parameter that has an association relationship with the target security parameter as the target public parameter that meets the target security parameter. Parameter extraction is performed on the target public parameter to obtain a generator of the target finite field as the first public parameter, and a maximum security integer is obtained as the second public parameter. A preset key value calculation function is used to calculate the key sharing value based on the first public parameter, the second public parameter and the second master key value to determine the second key sharing value.

[0104] The target public parameter is obtained and determined from the candidate public parameters according to the association relationship between the target security parameter and the candidate public parameter; the generator of the target finite field is obtained from the target public parameter as the first public parameter, and the maximum security integer corresponding to the candidate security integer is obtained from the target public parameter as the second public parameter; the second key sharing value is determined according to the first public parameter, the second public parameter and the second master key value, so as to ensure that the target public parameter complies with the security of the target security parameter and further ensure the security of the generated second key sharing value.

[0105] Optionally, determining the second key sharing value according to the first public parameter, the second public parameter, and the second master key value includes:

[0106] The second shared key value is determined using the following formula:

[0107] Sym_key B =g KeyB modn;

[0108] Among them, Sym_key B represents the second key shared value, g represents the first public parameter, i.e., the generator of the target finite field, n represents the second public parameter, i.e., the maximum secure integer corresponding to the candidate secure integer, mod represents the modulus operation, Key B Indicates the value of the second master key.

[0109] The first shared key value is determined by using the following formula: Sym_key B =g KeyB modn, since the second key sharing value is calculated by using the first public parameter, the second public parameter and the second master key value, the calculation complexity of the second key sharing value is increased, thereby reducing the possibility of the second key sharing value being cracked, and indirectly improving the security of the decryption key value.

[0110] S302: Obtain the encrypted transmission data and the first key sharing value sent by the data sending end, and determine the decryption key value according to the first key sharing value and the second key sharing value.

[0111] The first key sharing value is generated according to the first target security integer selected by the data sending end from the candidate security integers, and the encrypted transmission data is generated using the encryption method for transmission data provided by any embodiment of the present invention.

[0112] In one embodiment, the data transmitting end uses the communication channel between the data transmitting end and the data receiving end to send the first key sharing value to the data receiving end. The data receiving end obtains the first key sharing value sent by the data transmitting end, and calculates the decryption key value according to the first key sharing value generated at the data transmitting end and the second key sharing value generated at the data receiving end to determine the decryption key value.

[0113] Optionally, the data receiving end performs geometric calculation according to the first key sharing value and the second key sharing value, and determines the decryption key value according to the geometric calculation result. The geometric calculation may be a multiplication operation or the like.

[0114] For example, assuming that the first key sharing value is Key1 and the second key sharing value is Key2, the data receiving end performs a multiplication operation on "Key1" and "Key2" and uses the multiplication result "Key1*Key2" as the decryption key value.

[0115] For another example, assuming that the first key sharing value is Second shared key value Among them, Key A and Key B The data receiving end has a first master key value and a second master key value. A and Sym_key B Perform multiplication to calculate the decryption key value

[0116] S303: Decrypt the encrypted transmission data using the decryption key value to obtain the original transmission data.

[0117] In one implementation, after the data receiving end calculates the decryption key value, it uses the decryption key value to decrypt the encrypted transmission data according to a preset decryption algorithm to obtain the original transmission data.

[0118] Optionally, the data sender uses the decryption key value to use a symmetric decryption algorithm to decrypt the encrypted transmission data to obtain the original transmission data. For example, the original transmission data m is obtained in the following manner:

[0119] m = SymDec(C, Key′);

[0120] Among them, C represents encrypted transmission data, Key′ represents the decryption key value, and SymDec() represents the function expression corresponding to the symmetric decryption algorithm.

[0121] The present invention selects a second target security integer from candidate security integers as a second master key value, and generates a second key sharing value according to the second master key value; obtains encrypted transmission data and a first key sharing value sent by a data sending end, and determines a decryption key value according to the first key sharing value and the second key sharing value; wherein the first key sharing value is generated according to the first target security integer selected by the data sending end from the candidate security integers, and the encrypted transmission data is decrypted using the decryption key value to obtain the original transmission data. Since the decryption key is generated using the key sharing values ​​generated by the data sending end and the data receiving end respectively, even if the data receiving end is subjected to a malicious attack, the attacker cannot directly use the second key sharing value of the data receiving end to crack the decryption key value, thereby achieving a risk sharing effect, ensuring the security of the decryption key value, and further ensuring the security of the encrypted transmission data. For example, the attacker cannot crack the encrypted transmission data to obtain the original transmission data.

[0122] Optionally, after obtaining the original transmission data, it also includes:

[0123] 1) Select a fourth target security integer from the candidate security integers, and determine the second master key value fragmentation according to the difference between the second master key value and the fourth target security integer.

[0124] In one implementation, the data receiving end randomly selects a candidate security integer again as the fourth target security integer, and performs a difference operation based on the second master key value and the fourth target security integer to determine the second master key value fragment.

[0125] Optionally, assume that the randomly selected fourth target security integer is Key B1 , the second master key value is Key B , then the second master key value shard Key B2 =(Key B -Key B1)modn, n is the second common parameter.

[0126] 2) Obtain the third target security integer sent by the data sending end, and update the second master key value according to the sum of the second master key value fragment and the third target security integer to generate an updated second master key value.

[0127] The third target security integer is selected from the candidate security integers according to the data sending end.

[0128] In one implementation, the data transmitting end randomly selects a candidate security integer as the third target security integer again, and sends the third target security integer to the data receiving end. The data receiving end obtains the third target security integer sent by the data transmitting end, performs a sum operation based on the second master key value fragment and the third target security integer, and determines the updated second master key value based on the sum operation result.

[0129] Optionally, assume that the third target security integer randomly selected by the data sender is Key A1 , the second master key value is sharded as Key B2 , then the updated second master key value key′ B =(Key B2 +Key A1 )modn, n is the second common parameter.

[0130] 3) Generate an updated second key sharing value according to the updated second master key value.

[0131] Optional, assuming the updated second master key value is key B ′, then the updated second key sharing value Sym_key B ′=g keyB 'modn, n is the second common parameter.

[0132] The fourth target security integer is selected from the candidate security integers, and the second master key value slice is determined according to the difference between the second master key value and the fourth target security integer; the third target security integer sent by the data sending end is obtained, and the second master key value is updated according to the sum of the second master key value slice and the third target security integer to generate an updated second master key value; wherein the third target security integer is selected from the candidate security integers according to the data sending end; and the updated second key sharing value is generated according to the updated second master key value, so that the effect of timely updating the second master key value and the second key sharing value of the data receiving end is achieved whenever the data receiving end successfully decrypts the data, and the effect of timely updating the decryption key value is indirectly achieved, thereby increasing the security of the decryption key value, avoiding the risk of being cracked by continuously using a fixed decryption key value for data decryption, and improving the security of data encryption transmission.

[0133] Optionally, the method further includes:

[0134] The current time is compared with the deadline of data transmission; if the current time is the same as the deadline, the second master key value and the second key sharing value are deleted.

[0135] In one implementation, the data receiving end compares the current time with the deadline to determine whether the current time has reached the deadline. If the current time has not reached the deadline, that is, the current time is different from the deadline, the comparison continues; if the current time has reached the deadline, that is, the current time is the same as the deadline, indicating that a data transmission cycle has ended, the second master key value and the second key sharing value are deleted.

[0136] By comparing the current moment with the deadline for data transmission; when the current moment is the same as the deadline, the second master key value and the second key sharing value are deleted, so that when a data transmission cycle ends, the second master key value and the second key sharing value related to the decryption key generation are deleted in time, avoiding the risk of leakage of the second master key value and / or the second key sharing value, which may lead to the decryption key value being cracked, and increasing the security of the decryption key value.

[0137] Embodiment 4

[0138] Figure 4 This is a schematic diagram of the structure of a data transmission encryption device provided by the fourth embodiment of the present invention, and the device is configured in the data sending end. Figure 4 As shown, the device comprises:

[0139] A first key sharing value generating module 41, configured to select a first target security integer from candidate security integers as a first master key value, and generate a first key sharing value according to the first master key value;

[0140] The encrypted transmission data generating module 42 is used to determine the encryption key value according to the second key sharing value sent by the data receiving end and the first key sharing value, and use the encryption key value to encrypt the original transmission data to generate encrypted transmission data; wherein the second key sharing value is generated according to the second target security integer selected by the data receiving end from the candidate security integers;

[0141] The encrypted transmission data sending module 43 is used to send the encrypted transmission data and the first key sharing value to the data receiving end, so that the data receiving end can decrypt the encrypted transmission data according to the first key sharing value to obtain the original transmission data.

[0142] Optionally, the first shared key value generating module 41 is specifically configured to:

[0143] Acquire a target security parameter, and determine the target public parameter from the candidate public parameters according to an association relationship between the target security parameter and the candidate public parameters;

[0144] Obtaining a generator of a target finite field from the target public parameter as a first public parameter, and obtaining a maximum safe integer corresponding to the candidate safe integer from the target public parameter as a second public parameter;

[0145] The first key sharing value is determined according to the first public parameter, the second public parameter and the first master key value.

[0146] Optionally, the first shared key value generating module 41 is further configured to:

[0147] The first shared key value is determined using the following formula:

[0148] Sym_key A =g KeyA modn;

[0149] Among them, the Sym_key A represents the first key sharing value, g represents the first public parameter, n represents the second public parameter, and Key A Represents the first master key value.

[0150] Optionally, the device further includes a first key sharing value updating module, specifically configured to:

[0151] In response to a data decryption success signal sent by the data receiving end, selecting a third target security integer from the candidate security integers, and determining a first master key value fragmentation according to a difference between the first master key value and the third target security integer;

[0152] Obtaining a fourth target security integer sent by the data receiving end, and updating the first master key value according to the sum of the first master key value fragment and the fourth target security integer, to generate an updated first master key value; wherein the fourth target security integer is selected from the candidate security integers according to the data receiving end;

[0153] Generate an updated first key sharing value according to the updated first master key value.

[0154] Optionally, the device further includes a first data deletion module, specifically configured to:

[0155] Compare the current time with the deadline of data transmission;

[0156] When the current time is the same as the expiration time, the first master key value and the first key sharing value are deleted.

[0157] The transmission data encryption device provided in the fourth embodiment of the present invention can execute the transmission data encryption method provided in the first and second embodiments of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0158] Embodiment 5

[0159] Figure 5 This is a schematic diagram of the structure of a data transmission decryption device provided in Embodiment 5 of the present invention, and the device is configured in a data receiving terminal. Figure 5 As shown, the device comprises:

[0160] A second key sharing value generating module 51 is used to select a second target security integer from the candidate security integers as a second master key value, and generate a second key sharing value according to the second master key value;

[0161] a decryption key value determination module 52, configured to obtain the encrypted transmission data and the first key sharing value sent by the data sending end, and determine the decryption key value according to the first key sharing value and the second key sharing value; wherein the first key sharing value is generated according to the first target security integer selected by the data sending end from the candidate security integers, and the encrypted transmission data is generated by the encryption method of the transmission data as described above;

[0162] The data decryption module 53 is used to decrypt the encrypted transmission data using the decryption key value to obtain the original transmission data.

[0163] Optionally, the device further includes a second key sharing value updating module, specifically configured to:

[0164] Selecting a fourth target security integer from the candidate security integers, and determining a second master key value fragmentation according to a difference between the second master key value and the fourth target security integer;

[0165] Obtaining a third target security integer sent by the data sending end, and updating the second master key value according to the sum of the second master key value fragment and the third target security integer, to generate an updated second master key value; wherein the third target security integer is selected from the candidate security integers according to the data sending end;

[0166] Generate an updated second key sharing value according to the updated second master key value.

[0167] Optionally, the device further includes a second data deletion module, specifically configured to:

[0168] Compare the current time with the deadline of data transmission;

[0169] When the current time is the same as the expiration time, the second master key value and the second key sharing value are deleted.

[0170] The transmission data decryption device provided in the fifth embodiment of the present invention can execute the transmission data decryption method provided in the third embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0171] Embodiment 6

[0172] Figure 6 A schematic diagram of the structure of an electronic device 60 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0173] like Figure 6As shown, the electronic device 60 includes at least one processor 61, and a memory connected to the at least one processor 61, such as a read-only memory (ROM) 62, a random access memory (RAM) 63, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 61 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 62 or the computer program loaded from the storage unit 68 to the random access memory (RAM) 63. In the RAM 63, various programs and data required for the operation of the electronic device 60 can also be stored. The processor 61, the ROM 62, and the RAM 63 are connected to each other via a bus 64. An input / output (I / O) interface 65 is also connected to the bus 64.

[0174] A number of components in the electronic device 60 are connected to the I / O interface 65, including: an input unit 66, such as a keyboard, a mouse, etc.; an output unit 67, such as various types of displays, speakers, etc.; a storage unit 68, such as a disk, an optical disk, etc.; and a communication unit 69, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 69 allows the electronic device 60 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0175] The processor 61 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 61 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 61 performs the various methods and processes described above, such as a method for encrypting transmitted data and / or a method for decrypting transmitted data.

[0176] In some embodiments, the processing method of information push can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 68. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 60 via the ROM 62 and / or the communication unit 69. When the computer program is loaded into the RAM 63 and executed by the processor 61, one or more steps of the encryption method for transmission data and / or the decryption method for transmission data described above can be performed. Alternatively, in other embodiments, the processor 61 can be configured to execute the encryption method for transmission data and / or the decryption method for transmission data in any other appropriate manner (for example, by means of firmware).

[0177] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0178] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0179] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0180] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0181] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0182] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0183] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0184] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for encrypting transmitted data, executed by a data sending end, comprising: Selecting a first target security integer from the candidate security integers as a first master key value, and generating a first key sharing value according to the first master key value; Determine an encryption key value according to a second key sharing value sent by a data receiving end and the first key sharing value, and use the encryption key value to encrypt the original transmission data to generate encrypted transmission data; wherein the second key sharing value is generated according to a second target security integer selected by the data receiving end from the candidate security integers; The encrypted transmission data and the first key sharing value are sent to the data receiving end, so that the data receiving end can decrypt the encrypted transmission data according to the first key sharing value to obtain the original transmission data.

2. The method according to claim 1, characterized in that The generating a first key sharing value according to the first master key value includes: Acquire a target security parameter, and determine the target public parameter from the candidate public parameters according to an association relationship between the target security parameter and the candidate public parameters; Obtaining a generator of a target finite field from the target public parameter as a first public parameter, and obtaining a maximum safe integer corresponding to the candidate safe integer from the target public parameter as a second public parameter; The first key sharing value is determined according to the first public parameter, the second public parameter and the first master key value.

3. The method according to claim 2, characterized in that The determining the first key sharing value according to the first public parameter, the second public parameter and the first master key value includes: The first shared key value is determined using the following formula: Sym_key A =g KeyA fashion; Among them, the Sym_key A represents the first key sharing value, g represents the first public parameter, n represents the second public parameter, and Key A Represents the first master key value.

4. The method according to claim 1, after sending the encrypted transmission data and the first key sharing value to the data receiving end, further comprising: In response to a data decryption success signal sent by the data receiving end, selecting a third target security integer from the candidate security integers, and determining a first master key value fragmentation according to a difference between the first master key value and the third target security integer; Obtaining a fourth target security integer sent by the data receiving end, and updating the first master key value according to the sum of the first master key value fragment and the fourth target security integer, to generate an updated first master key value; wherein the fourth target security integer is selected from the candidate security integers according to the data receiving end; Generate an updated first key sharing value according to the updated first master key value.

5. The method according to claim 1, further comprising: Compare the current time with the deadline of data transmission; When the current time is the same as the expiration time, the first master key value and the first key sharing value are deleted.

6. A method for decrypting transmitted data, executed by a data receiving end, comprising: Selecting a second target secure integer from the candidate secure integers as a second master key value, and generating a second key sharing value according to the second master key value; Obtaining the encrypted transmission data and the first key sharing value sent by the data sending end, and determining the decryption key value according to the first key sharing value and the second key sharing value; wherein the first key sharing value is generated according to the first target security integer selected by the data sending end from the candidate security integers, and the encrypted transmission data is generated by the encryption method of the transmission data according to any one of claims 1 to 5; The encrypted transmission data is decrypted using the decryption key value to obtain the original transmission data.

7. The method according to claim 6, after obtaining the original transmission data, further comprising: Selecting a fourth target security integer from the candidate security integers, and determining a second master key value fragmentation according to a difference between the second master key value and the fourth target security integer; Obtaining a third target security integer sent by the data sending end, and updating the second master key value according to the sum of the second master key value fragment and the third target security integer, to generate an updated second master key value; wherein the third target security integer is selected from the candidate security integers according to the data sending end; Generate an updated second key sharing value according to the updated second master key value.

8. The method according to claim 7, further comprising: Compare the current time with the deadline of data transmission; When the current time is the same as the expiration time, the second master key value and the second key sharing value are deleted.

9. A data transmission encryption device, configured at a data sending end, comprising: A first key sharing value generating module, configured to select a first target security integer from candidate security integers as a first master key value, and generate a first key sharing value according to the first master key value; an encrypted transmission data generating module, configured to determine an encryption key value according to a second key sharing value sent by a data receiving end and the first key sharing value, and to encrypt the original transmission data using the encryption key value to generate encrypted transmission data; wherein the second key sharing value is generated according to a second target security integer selected by the data receiving end from the candidate security integers; The encrypted transmission data sending module is used to send the encrypted transmission data and the first key sharing value to the data receiving end, so that the data receiving end can decrypt the encrypted transmission data according to the first key sharing value to obtain the original transmission data.

10. A decryption device for transmission data, configured at a data receiving end, comprising: A second key sharing value generating module, configured to select a second target security integer from the candidate security integers as a second master key value, and generate a second key sharing value according to the second master key value; a decryption key value determination module, configured to obtain the encrypted transmission data and a first key sharing value sent by the data sending end, and determine the decryption key value according to the first key sharing value and the second key sharing value; wherein the first key sharing value is generated according to a first target security integer selected by the data sending end from the candidate security integers, and the encrypted transmission data is generated by the transmission data encryption method according to any one of claims 1 to 5; The data decryption module is used to decrypt the encrypted transmission data using the decryption key value to obtain the original transmission data.

11. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 5 and / or 6 to 8.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to execute the method of any one of claims 1-5 and / or 6-8.

13. A computer program product, comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1-5 and / or 6-8.

Images