Encryption and decryption method, device and equipment for transmitting data, medium and product

Abstract

The application discloses a kind of encryption and decryption method, device, equipment, medium and product of transmission data, it is related to information security technical field, comprising: selecting first target security integer from candidate security integer as first master key value, and generating first key sharing value according to first master key value;According to the second key sharing value sent by data receiving end and the first key sharing value, determine the encryption key value, and the original transmission data is encrypted using encryption key value, and generates encrypted transmission data;Wherein, the second key sharing value is generated according to the second target security integer selected from candidate security integer by data receiving end;Encrypted transmission data and first key sharing value are sent to data receiving end, for data receiving end to decrypt encrypted transmission data according to first key sharing value, for obtaining original transmission data.The application guarantees the security of key, further guarantees the security of encrypted transmission data.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method, apparatus, device, medium and product for encrypting and decrypting transmitted data. Background Technology

[0002] With the rapid development of internet technology, more and more businesses have data transmission needs, and their data transmission methods have evolved from paper-based to electronic, which undoubtedly greatly improves the convenience of data transmission. However, along with the rise of electronic transmission, malicious attacks targeting transmitted data have also become increasingly rampant, thus necessitating encrypted data transmission.

[0003] In traditional data encryption methods, the key is usually generated by a single user terminal. This makes the key vulnerable to leakage when the user terminal is maliciously attacked, affecting the security of encrypted data transmission. Summary of the Invention

[0004] This invention provides a method, apparatus, device, medium, and product for encrypting and decrypting transmitted data, in order to solve the problem that existing technologies rely on a single user terminal to generate keys, resulting in poor security for encrypted data transmission.

[0005] According to one aspect of the present invention, a method for encrypting transmitted data is provided, executed by a data sending end, comprising:

[0006] Select a first target secure integer from the candidate secure integers as the first master key value, and generate a first key sharing value based on the first master key value;

[0007] Based on the second key sharing value and the first key sharing value sent by the data receiving end, an encryption key value is determined, and the original transmitted data is encrypted using the encryption key value to generate encrypted transmitted data; wherein, the second key sharing value is generated based on the second target security integer selected by the data receiving end from the candidate security integers;

[0008] The encrypted transmission data and the first key sharing value are sent to the data receiving end, so that the data receiving end can decrypt the encrypted transmission data according to the first key sharing value to obtain the original transmission data.

[0009] According to another aspect of the present invention, a method for decrypting transmitted data is provided, executed by a data receiving end, comprising:

[0010] Select the second target security integer from the candidate security integers as the second master key value, and generate the second key sharing value based on the second master key value;

[0011] The encrypted transmission data sent by the data sender and a first key sharing value are obtained, and a decryption key value is determined based on the first key sharing value and the second key sharing value; wherein, the first key sharing value is generated based on a first target security integer selected by the data sender from the candidate security integers, and the encrypted transmission data is generated using the encryption method for transmission data as described in any one of the present invention;

[0012] The encrypted transmission data is decrypted using the decryption key value to obtain the original transmission data.

[0013] According to another aspect of the present invention, an encryption device for transmitting data is provided, configured at a data sending end, comprising:

[0014] The first key sharing value generation module is used to select a first target security integer from candidate security integers as a first master key value, and generate a first key sharing value based on the first master key value;

[0015] An encrypted transmission data generation module is used to determine an encryption key value based on a second key sharing value sent by a data receiving end and a first key sharing value, and to encrypt the original transmission data using the encryption key value to generate encrypted transmission data; wherein, the second key sharing value is generated based on a second target security integer selected by the data receiving end from the candidate security integers;

[0016] An encrypted data transmission module is used to send the encrypted transmission data and the first key sharing value to the data receiving end, so that the data receiving end can decrypt the encrypted transmission data according to the first key sharing value to obtain the original transmission data.

[0017] According to another aspect of the present invention, a data decryption device is provided, configured at a data receiving end, comprising:

[0018] The second key sharing value generation module is used to select a second target security integer from the candidate security integers as the second master key value, and generate a second key sharing value based on the second master key value.

[0019] The decryption key value determination module is used to obtain the encrypted transmission data sent by the data sender and the first key sharing value, and determine the decryption key value based on the first key sharing value and the second key sharing value; wherein, the first key sharing value is generated based on the first target security integer selected by the data sender from the candidate security integers, and the encrypted transmission data is generated using the encryption method for transmission data as described in any one of the present invention;

[0020] The data decryption module is used to decrypt the encrypted transmission data using the decryption key value to obtain the original transmission data.

[0021] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0022] At least one processor; and

[0023] A memory communicatively connected to the at least one processor; wherein,

[0024] The memory stores a computer program that can be executed by the at least one processor to enable the at least one processor to perform the method described in any one of the present invention.

[0025] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the method described in any one of the present invention.

[0026] According to another aspect of the present invention, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method described in any one of the present invention.

[0027] This invention selects a first target secure integer from candidate secure integers as a first master key value and generates a first key sharing value based on the first master key value. It then determines an encryption key value based on a second key sharing value sent by the data receiving end and the first key sharing value, and uses the encryption key value to encrypt the original transmitted data to generate encrypted transmitted data. The second key sharing value is generated based on a second target secure integer selected by the data receiving end from the candidate secure integers. Since the encryption key is generated using the key sharing values ​​generated by both the data sending and receiving ends, even if either end is maliciously attacked, it is impossible to directly use that end's key sharing value to crack the encryption key. This achieves a risk-sharing effect, ensuring the security of the encryption key and further guaranteeing the security of the encrypted transmitted data.

[0028] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 This is a flowchart of a data encryption method provided in Embodiment 1 of the present invention;

[0031] Figure 2 This is a flowchart of a data encryption method provided in Embodiment 2 of the present invention;

[0032] Figure 3 This is a flowchart of a data decryption method provided in Embodiment 3 of the present invention;

[0033] Figure 4 This is a schematic diagram of the structure of a data encryption device provided in Embodiment 4 of the present invention;

[0034] Figure 5 This is a schematic diagram of the structure of a data decryption device provided in Embodiment 5 of the present invention;

[0035] Figure 6 This is a schematic diagram of the structure of an electronic device that implements the encryption method and / or decryption method for transmitting data according to embodiments of the present invention. Detailed Implementation

[0036] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0037] It should be noted that the terms "target," "candidate," "first," "second," "third," "fourth," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0038] In traditional data encryption methods, the key is typically generated by a single user terminal. This makes the key vulnerable to leakage when the user terminal is compromised by malicious attacks, compromising the security of encrypted data transmission. For example, if the encryption key is generated by the data sender, it is easily leaked if the sender is compromised, allowing attackers to easily tamper with the encrypted data. Similarly, if the decryption key is generated by the data receiver, it is easily leaked if the receiver is compromised, allowing attackers to easily crack the encrypted data. Clearly, traditional data encryption methods cannot guarantee key security, further contributing to poor security in encrypted data transmission.

[0039] Example 1

[0040] Figure 1 This is a flowchart of a data encryption method according to Embodiment 1 of the present invention. This embodiment is applicable to situations where the data sending end generates encrypted transmission data using an encryption key and sends it to the data receiving end. This method can be executed by a data encryption device configured in the data sending end, and can be implemented in hardware and / or software. The data sending end can be any terminal with data transmission needs, such as a smartphone, computer, or server, etc. This embodiment does not limit the specific type of data sending end. Figure 1 As shown, the method includes:

[0041] S101. Select a first target security integer from the candidate security integers as the first master key value, and generate a first key sharing value based on the first master key value.

[0042] Here, a security integer refers to a set of numbers uniquely determined by the target security parameters. In this embodiment, a security integer of a preset length is selected as a candidate security integer. For example, a security integer with a security level that matches the magnitude of the target security parameters can be selected as a candidate security integer.

[0043] In one implementation, the data sender obtains candidate secure integers and randomly selects one as the first target secure integer, and uses the randomly selected first target secure integer as the first master key value. For example, suppose the first target secure integer randomly selected by the data sender from the candidate secure integers is "2". 31 ", then "2" 31 "As the first master key value."

[0044] The data sending end obtains a preset key sharing value calculation function, uses the first master key value as the independent variable of the key sharing value calculation function, performs the function operation, and generates the first key sharing value based on the calculation result. The key sharing value calculation function can be set according to actual business needs.

[0045] S102. Based on the second key sharing value and the first key sharing value sent by the data receiving end, determine the encryption key value, and use the encryption key value to encrypt the original transmitted data to generate encrypted transmitted data.

[0046] The second shared key value is generated based on the second target secure integer selected by the data receiver from the candidate secure integers. The encryption key value refers to the key used to encrypt the original transmitted data, which refers to the plain text data without any encryption processing, that is, the plain text data that the data sender and data receiver expect to transmit.

[0047] In one implementation, the data receiving end acquires candidate secure integers and randomly selects one as the second target secure integer, using the randomly selected second target secure integer as the second master key value. The data receiving end acquires a preset key-sharing value operation function, performs a function operation using the second master key value as the independent variable of the key-sharing value operation function, and generates the second key-sharing value based on the operation result. The data receiving end then transmits the second key-sharing value to the data sending end via the communication channel between the data receiving end and the data sending end.

[0048] The data sending end obtains the second key sharing value sent by the data receiving end, and calculates the encryption key value based on the first key sharing value generated at the data sending end and the second key sharing value generated at the data receiving end to determine the encryption key value.

[0049] Optionally, the data sender performs algebraic calculations based on the first and second key-sharing values, and determines the encryption key value based on the algebraic calculation result. The algebraic calculations can include multiplication operations, etc.

[0050] For example, assuming the first shared key value is Key1 and the second shared key value is Key2, the data sender performs a multiplication operation on "Key1" and "Key2" and uses the result "Key1*Key2" as the encryption key value.

[0051] For example, suppose the first key sharing value Second key sharing value Among them, Key A and Key B These are the first master key value and the second master key value, respectively. The data sender uses the Sym_key... A and Sym_keyB Perform multiplication to calculate the encryption key value.

[0052] After the data sending end calculates the encryption key value, it uses the encryption key value to encrypt the original transmitted data according to the preset encryption algorithm to generate encrypted transmitted data.

[0053] Optionally, the data sender uses the encryption key value and a symmetric encryption algorithm to encrypt the original transmitted data, generating encrypted transmitted data. For example, the encrypted transmitted data C can be calculated as follows:

[0054] C = SymEnc(m, Key);

[0055] Where m represents the original transmitted data, Key represents the encryption key value, and SymEnc() represents the function expression corresponding to the symmetric encryption algorithm.

[0056] S103. Send the encrypted transmission data and the first key sharing value to the data receiving end, so that the data receiving end can decrypt the encrypted transmission data according to the first key sharing value to obtain the original transmission data.

[0057] In one implementation, the data sender uses a communication channel with the data receiver to send encrypted transmission data and a first shared key value to the data receiver. After receiving the encrypted transmission data and the first shared key value, the data receiver uses the first shared key value and a second shared key value to determine a decryption key value, and then decrypts the encrypted transmission data according to the decryption key value to obtain the original transmission data.

[0058] This invention selects a first target security integer from candidate security integers as a first master key value and generates a first key sharing value based on the first master key value. It then determines an encryption key value based on a second key sharing value sent by the data receiver and the first key sharing value, and uses the encryption key value to encrypt the original transmitted data, generating encrypted transmitted data. The second key sharing value is generated based on a second target security integer selected by the data receiver from the candidate security integers. Since the encryption key is generated using the key sharing values ​​generated by both the data sender and the data receiver, even if the data sender suffers a malicious attack, the attacker cannot directly use the first key sharing value of the data sender to crack the encryption key value. This achieves a risk-sharing effect, ensuring the security of the encryption key value and further guaranteeing the security of the encrypted transmitted data. For example, attackers cannot tamper with the content of the encrypted transmitted data.

[0059] Example 2

[0060] Figure 2This is a flowchart of a data encryption method provided in Embodiment 2 of the present invention. This embodiment further optimizes and extends Embodiment 1 above, and can be combined with the various optional implementation methods described above. For example... Figure 2 As shown, the method includes:

[0061] S201. Select the first target security integer from the candidate security integers as the first master key value.

[0062] S202. Obtain the target security parameters, and determine the target common parameters from the candidate common parameters based on the correlation between the target security parameters and the candidate common parameters.

[0063] Among them, security parameters are quantitative indicators that measure system security. Security parameters determine the difficulty for an attacker to breach the system using specific methods, thus indirectly reflecting the system's security. Understandably, the higher the security parameters, the more difficult it is to breach the system. Target security parameters, on the other hand, are quantitative indicators that measure the difficulty of cracking the keys (encryption and / or decryption keys) in this method.

[0064] Common parameters are a set of parameters used during encryption and decryption to ensure that the data sender and receiver can correctly perform encryption and decryption operations. Common parameters typically include some fixed mathematical constants or values. Target common parameters are selected from the candidate common parameters based on the target security parameters.

[0065] In one implementation, a safety parameter calculation algorithm is used to calculate the target safety parameter, and based on the correlation between the target safety parameter and the candidate common parameter, the candidate common parameter that has a correlation with the target safety parameter is taken as the target common parameter that conforms to the target safety parameter.

[0066] For example, assuming the target safety parameter is λ1, and the candidate common parameter that is related to the target safety parameter λ1 is pp1, then pp1 is taken as the target common parameter that conforms to the target safety parameter λ1.

[0067] S203. Obtain the generator of the target finite field from the target common parameters as the first common parameter, and obtain the largest safe integer corresponding to the candidate safe integer from the target common parameters as the second common parameter.

[0068] Here, the target finite field refers to a field containing a finite number of elements, and the generator of the target finite field refers to an element g in the target finite field such that for any non-zero element b in the target finite field, b equals a power of g. The maximum safe integer refers to the largest integer among the candidate safe integers, that is, the upper bound of the candidate safe integers.

[0069] In one implementation, the target common parameters are extracted to obtain the generator of the target finite field as the first common parameter, and the maximum safe integer is obtained as the second common parameter.

[0070] S204. Generate a first key sharing value based on the first common parameter, the second common parameter, and the first master key value.

[0071] In one implementation, a preset key value calculation function is used to calculate the key sharing value based on the first public parameter, the second public parameter, and the first master key value, thereby determining the first key sharing value.

[0072] By acquiring the target security parameters and determining the target public parameters from the candidate public parameters based on the correlation between the target security parameters and the candidate public parameters, the generator of the target finite field is obtained from the target public parameters as the first public parameter, and the largest security integer corresponding to the candidate security integer is obtained from the target public parameters as the second public parameter. Based on the first public parameter, the second public parameter, and the first master key value, a first key sharing value is generated to ensure that the target public parameters conform to the security of the target security parameters and further ensure the security of the generated first key sharing value.

[0073] Optionally, the first key sharing value is determined based on the first public parameter, the second public parameter, and the first master key value, including:

[0074] The first key sharing value is determined using the following formula:

[0075] Sym_key A =g KeyA modn;

[0076] Among them, Sym_key A The first key shared value is represented by g, which represents the first common parameter, i.e., the generator of the target finite field. n represents the second common parameter, i.e., the largest secure integer corresponding to the candidate secure integer. mod represents the modulo operation. A This represents the first master key value.

[0077] The first key sharing value is determined using the following formula: Sym_key A =g KeyA The modn algorithm uses the first common parameter, the second common parameter, and the first master key value to calculate the first key shared value. This increases the computational complexity of the first key shared value, thereby reducing the possibility of the first key shared value being cracked and indirectly improving the security of the encryption key value.

[0078] S205. Based on the second key sharing value and the first key sharing value sent by the data receiving end, determine the encryption key value, and use the encryption key value to encrypt the original transmitted data to generate encrypted transmitted data.

[0079] S206. Send the encrypted transmission data and the first key sharing value to the data receiving end, so that the data receiving end can decrypt the encrypted transmission data according to the first key sharing value to obtain the original transmission data.

[0080] Optionally, after sending the encrypted transmission data and the first key sharing value to the data receiver, the method further includes:

[0081] 1) In response to the data decryption success signal sent by the data receiver, select the third target security integer from the candidate security integers, and determine the fragmentation of the first master key value based on the difference between the first master key value and the third target security integer.

[0082] In one implementation, after the data receiving end successfully decrypts the original transmitted data, it sends a data decryption success signal to the data sending end. In response to the data decryption success signal, the data sending end randomly selects another candidate security integer as the third target security integer, and performs a difference operation based on the first master key value and the third target security integer to determine the fragmentation of the first master key value.

[0083] Optionally, assume that the randomly selected third target security integer is Key. A1 The first master key value is Key A Then the first master key value is a fragment of the Key. A2 =(Key A -Key A1 )modn, where n is the second common parameter.

[0084] 2) Obtain the fourth target security integer sent by the data receiver, and update the first master key value according to the sum between the first master key value fragment and the fourth target security integer to generate the updated first master key value.

[0085] The fourth target security integer is selected from the candidate security integers by the data receiver.

[0086] In one implementation, the data receiver randomly selects another candidate secure integer as the fourth target secure integer and sends it to the data sender. The data sender obtains the fourth target secure integer sent by the data receiver, performs a sum operation based on the first master key value fragment and the fourth target secure integer, and determines the updated first master key value based on the sum operation result.

[0087] Optionally, assume that the fourth target secure integer randomly selected by the data receiver is Key.B1 The first master key value is fragmented into Key. A2 Then the updated first master key value key′ A =(Key A2 +Key B1 )modn, where n is the second common parameter.

[0088] 3) Generate the updated first key sharing value based on the updated first master key value.

[0089] Optionally, assume the updated first master key value is key. A ′, then the updated first key sharing value Sym_key A ′=g keyA 'mod n, where n is the second common parameter.

[0090] In response to a successful data decryption signal sent by the data receiver, a third target security integer is selected from candidate security integers. The first master key value is then fragmented based on the difference between the first master key value and the third target security integer. A fourth target security integer sent by the data receiver is obtained, and the first master key value is updated based on the sum of the first master key value fragments and the fourth target security integer, generating an updated first master key value. The fourth target security integer is selected by the data receiver from the candidate security integers. An updated first key sharing value is generated based on the updated first master key value. This achieves the effect of timely updating the first master key value and the first key sharing value of the data sender whenever the data receiver successfully decrypts data. This indirectly achieves the effect of timely updating the encryption key value, increasing the security of the encryption key value, avoiding the risk of being cracked by continuously using a fixed encryption key value for data encryption, and improving the security of encrypted data transmission.

[0091] Optionally, the method also includes:

[0092] Compare the current time with the data transmission deadline; if the current time and the deadline are the same, delete the first master key value and the first key sharing value.

[0093] The data transmission cutoff time refers to the end time of a data transmission cycle.

[0094] In one implementation, the data sender compares the current time with the cutoff time to determine whether the current time has reached the cutoff time. If the current time has not reached the cutoff time, i.e., the current time and the cutoff time are different, the comparison continues; if the current time has reached the cutoff time, i.e., the current time and the cutoff time are the same, it indicates that a data transmission cycle has ended, and the first master key value and the first key sharing value are deleted.

[0095] By comparing the current time with the data transmission deadline, and deleting the first master key value and the first key shared value when the current time and the deadline are the same, the first master key value and the first key shared value related to the generation of the encryption key are deleted in a timely manner when a data transmission cycle ends. This avoids the risk of leakage of the first master key value and / or the first key shared value, which may lead to the encryption key value being cracked, and increases the security of the encryption key value.

[0096] Example 3

[0097] Figure 3 This is a flowchart of a data decryption method provided in Embodiment 3 of the present invention. This embodiment is applicable to situations where the data receiving end uses a decryption key to extract the original transmitted data. The method can be executed by a data decryption device configured in the data receiving end, and can be implemented in hardware and / or software. The data receiving end can be any terminal with data receiving needs, such as a smartphone, computer, or server, etc. This embodiment does not limit the specific type of data receiving end. Figure 3 As shown, the method includes:

[0098] S301. Select the second target security integer from the candidate security integers as the second master key value, and generate the second key sharing value based on the second master key value.

[0099] In one implementation, the data receiver acquires candidate secure integers and randomly selects one as the second target secure integer, using the randomly selected second target secure integer as the second master key value. For example, suppose the second target secure integer randomly selected by the data receiver from the candidate secure integers is "2". 30 ", then "2" 30 "As the second master key value."

[0100] The data receiving end obtains a preset key-sharing value calculation function, uses the second master key value as the independent variable of the key-sharing value calculation function, and generates the second key-sharing value based on the calculation result. The key-sharing value calculation function can be set according to actual business needs.

[0101] Optionally, a second key-sharing value is generated based on the second master key value, including:

[0102] Obtain the target security parameters, and determine the target public parameters from the candidate public parameters based on the correlation between the target security parameters and the candidate public parameters; obtain the generator of the target finite field from the target public parameters as the first public parameter, and obtain the largest security integer corresponding to the candidate security integer from the target public parameters as the second public parameter; determine the second key sharing value based on the first public parameter, the second public parameter, and the second master key value.

[0103] In one implementation, the data receiving end uses a security parameter calculation algorithm to calculate the target security parameters. Based on the correlation between the target security parameters and candidate common parameters, candidate common parameters that are correlated with the target security parameters are selected as target common parameters that conform to the target security parameters. Parameter extraction is performed on the target common parameters to obtain the generator of the target finite field, which is used as the first common parameter, and the largest secure integer is obtained as the second common parameter. A preset key value calculation function is used to calculate the key sharing value based on the first common parameter, the second common parameter, and the second master key value to determine the second key sharing value.

[0104] By acquiring the target security parameters and determining the target public parameters from the candidate public parameters based on the correlation between the target security parameters and the candidate public parameters, the generator of the target finite field is obtained from the target public parameters as the first public parameter, and the largest secure integer corresponding to the candidate secure integer is obtained from the target public parameters as the second public parameter. Based on the first public parameter, the second public parameter, and the second master key value, the second key sharing value is determined to ensure that the target public parameters conform to the security of the target security parameters and further ensure the security of the generated second key sharing value.

[0105] Optionally, the second key-sharing value is determined based on the first public parameter, the second public parameter, and the second master key value, including:

[0106] The second key-sharing value is determined using the following formula:

[0107] Sym_key B =g KeyB modn;

[0108] Among them, Sym_key B The key represents the second shared key value, g represents the first common parameter, i.e., the generator of the target finite field, n represents the second common parameter, i.e., the largest secure integer corresponding to the candidate secure integer, and mod represents the modulo operation. B This represents the second master key value.

[0109] The first key sharing value is determined using the following formula: Sym_key B =g KeyB The modn method uses the first common parameter, the second common parameter, and the second master key value to calculate the second key shared value, which increases the computational complexity of the second key shared value, thereby reducing the possibility of the second key shared value being cracked and indirectly improving the security of the decryption key value.

[0110] S302. Obtain the encrypted transmission data and the first key sharing value sent by the data sending end, and determine the decryption key value based on the first key sharing value and the second key sharing value.

[0111] The first key shared value is generated based on the first target security integer selected by the data sender from the candidate security integers, and the encrypted transmission data is generated using the encryption method for transmission data provided in any embodiment of the present invention.

[0112] In one implementation, the data sender transmits a first key-shared value to the data receiver via a communication channel with the data receiver. The data receiver obtains the first key-shared value transmitted by the data sender and calculates a decryption key value based on the first key-shared value generated at the data sender and the second key-shared value generated at the data receiver to determine the decryption key value.

[0113] Optionally, the data receiving end performs geometric calculations based on the first key sharing value and the second key sharing value, and determines the decryption key value based on the result of the geometric calculations. The geometric calculations can include multiplication operations, etc.

[0114] For example, assuming the first shared key value is Key1 and the second shared key value is Key2, the data receiving end performs a multiplication operation on "Key1" and "Key2" and uses the result "Key1*Key2" as the decryption key value.

[0115] For example, suppose the first key sharing value Second key sharing value Among them, Key A and Key B These are the first master key value and the second master key value, respectively. The data receiver uses Sym_key... A and Sym_key B Perform multiplication to calculate the decryption key value.

[0116] S303. Use the decryption key value to decrypt the encrypted transmission data and obtain the original transmission data.

[0117] In one implementation, after the data receiving end calculates the decryption key value, it uses the decryption key value to decrypt the encrypted transmitted data according to a preset decryption algorithm to obtain the original transmitted data.

[0118] Optionally, the data sender uses the decryption key value and a symmetric decryption algorithm to decrypt the encrypted transmitted data to obtain the original transmitted data. For example, the original transmitted data m can be obtained in the following way:

[0119] m = SymDec(C, Key′);

[0120] Where C represents encrypted data transmission, Key′ represents the decryption key value, and SymDec() represents the function expression corresponding to the symmetric decryption algorithm.

[0121] This invention selects a second target security integer from candidate security integers as the second master key value and generates a second key sharing value based on the second master key value; it obtains the encrypted transmission data sent by the data sender and the first key sharing value, and determines the decryption key value based on the first key sharing value and the second key sharing value; wherein, the first key sharing value is generated based on the first target security integer selected by the data sender from the candidate security integers, and the decryption key value is used to decrypt the encrypted transmission data to obtain the original transmission data. Since the decryption key is generated using the key sharing values ​​generated by the data sender and the data receiver respectively, even if the data receiver is subjected to malicious attacks, the attacker cannot directly use the second key sharing value of the data receiver to crack the decryption key value, which achieves the effect of risk sharing, ensures the security of the decryption key value, and further ensures the security of the encrypted transmission data. For example, the attacker cannot crack the encrypted transmission data to obtain the original transmission data.

[0122] Optionally, after obtaining the raw transmission data, the following may also be included:

[0123] 1) Select the fourth target security integer from the candidate security integers, and determine the second master key value fragment based on the difference between the second master key value and the fourth target security integer.

[0124] In one implementation, the data receiving end randomly selects another candidate security integer as the fourth target security integer, and performs a difference operation based on the second master key value and the fourth target security integer to determine the fragmentation of the second master key value.

[0125] Optionally, assume that the randomly selected fourth target security integer is Key. B1 The second master key value is Key B Then the second master key value is fragmented into Key. B2 =(Key B -Key B1)modn, where n is the second common parameter.

[0126] 2) Obtain the third target security integer sent by the data sender, and update the second master key value according to the sum between the second master key value fragment and the third target security integer to generate the updated second master key value.

[0127] The third target security integer is selected from the candidate security integers by the data sender.

[0128] In one implementation, the data sender randomly selects another candidate secure integer as the third target secure integer and sends it to the data receiver. The data receiver obtains the third target secure integer sent by the data sender, performs a summation operation based on the second master key value fragment and the third target secure integer, and determines the updated second master key value based on the summation operation result.

[0129] Optionally, assume that the third target secure integer randomly selected by the data sender is Key. A1 The second master key value is fragmented into Key. B2 Then the updated second master key value key′ B =(Key B2 +Key A1 )modn, where n is the second common parameter.

[0130] 3) Generate an updated second key sharing value based on the updated second master key value.

[0131] Optionally, assume the updated second master key value is key. B ′, then the updated second key sharing value Sym_key B ′=g keyB 'mod n, where n is the second common parameter.

[0132] By selecting a fourth target security integer from candidate security integers and determining the second master key value fragment based on the difference between the second master key value and the fourth target security integer, the second master key value is obtained. The third target security integer sent by the data sender is acquired, and the second master key value is updated based on the sum of the second master key value fragments and the third target security integer, generating an updated second master key value. The third target security integer is selected by the data sender from the candidate security integers. An updated second key sharing value is generated based on the updated second master key value. This achieves the effect of timely updating the second master key value and the second key sharing value of the data receiver whenever the data receiver successfully decrypts the data. This indirectly achieves the effect of timely updating the decryption key value, increasing the security of the decryption key value, avoiding the risk of being cracked by continuously using a fixed decryption key value for data decryption, and improving the security of encrypted data transmission.

[0133] Optionally, the method also includes:

[0134] Compare the current time with the data transmission deadline; if the current time and the deadline are the same, delete the second master key value and the second key shared value.

[0135] In one implementation, the data receiving end compares the current time with the cutoff time to determine whether the current time has reached the cutoff time. If the current time has not reached the cutoff time, that is, the current time is different from the cutoff time, the comparison continues; if the current time has reached the cutoff time, that is, the current time is the same as the cutoff time, it indicates that a data transmission cycle has ended, and the second master key value and the second key shared value are deleted.

[0136] By comparing the current time with the data transmission deadline, and deleting the second master key value and the second key shared value when the current time and the deadline are the same, the second master key value and the second key shared value associated with the decryption key generation are deleted in a timely manner when a data transmission cycle ends. This avoids the risk of leakage of the second master key value and / or the second key shared value, which could lead to the decryption key value being cracked, and increases the security of the decryption key value.

[0137] Example 4

[0138] Figure 4 This is a schematic diagram of a data encryption device provided in Embodiment 4 of the present invention, which is configured in the data sending end. Figure 4 As shown, the device includes:

[0139] The first key sharing value generation module 41 is used to select a first target security integer from the candidate security integers as the first master key value, and generate a first key sharing value based on the first master key value;

[0140] The encrypted transmission data generation module 42 is used to determine an encryption key value based on the second key sharing value sent by the data receiving end and the first key sharing value, and to encrypt the original transmission data using the encryption key value to generate encrypted transmission data; wherein, the second key sharing value is generated based on the second target security integer selected by the data receiving end from the candidate security integers;

[0141] The encrypted transmission data sending module 43 is used to send the encrypted transmission data and the first key sharing value to the data receiving end, so that the data receiving end can decrypt the encrypted transmission data according to the first key sharing value to obtain the original transmission data.

[0142] Optionally, the first key sharing value generation module 41 is specifically used for:

[0143] Obtain the target security parameters, and determine the target common parameters from the candidate common parameters based on the correlation between the target security parameters and the candidate common parameters;

[0144] The generator of the target finite field is obtained from the target common parameters as the first common parameter, and the maximum safe integer corresponding to the candidate safe integer is obtained from the target common parameters as the second common parameter.

[0145] The first key sharing value is determined based on the first public parameter, the second public parameter, and the first master key value.

[0146] Optionally, the first key sharing value generation module 41 is further used for:

[0147] The first key-sharing value is determined using the following formula:

[0148] Sym_key A =g KeyA modn;

[0149] Among them, the Sym_key A The first key sharing value is represented by g, the first public parameter is represented by n, and the key is represented by n. A This represents the first master key value.

[0150] Optionally, the device further includes a first key-sharing value update module, specifically used for:

[0151] In response to the data decryption success signal sent by the data receiving end, a third target security integer is selected from the candidate security integers, and the first master key value is fragmented according to the difference between the first master key value and the third target security integer;

[0152] The system obtains the fourth target security integer sent by the data receiving end, and updates the first master key value according to the sum of the first master key value fragment and the fourth target security integer to generate the updated first master key value; wherein, the fourth target security integer is selected by the data receiving end from the candidate security integers;

[0153] An updated first key sharing value is generated based on the updated first master key value.

[0154] Optionally, the device further includes a first data deletion module, specifically used for:

[0155] Compare the current time with the data transmission deadline;

[0156] If the current time is the same as the cutoff time, delete the first master key value and the first key sharing value.

[0157] The data encryption device provided in Embodiment 4 of the present invention can execute the data encryption methods provided in Embodiments 1 and 2 of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0158] Example 5

[0159] Figure 5 This is a schematic diagram of a data decryption device provided in Embodiment 5 of the present invention, which is configured in a data receiving end. Figure 5 As shown, the device includes:

[0160] The second key sharing value generation module 51 is used to select a second target security integer from the candidate security integers as the second master key value, and generate a second key sharing value based on the second master key value.

[0161] The decryption key value determination module 52 is used to obtain the encrypted transmission data sent by the data sending end and the first key sharing value, and determine the decryption key value according to the first key sharing value and the second key sharing value; wherein, the first key sharing value is generated according to the first target security integer selected by the data sending end from the candidate security integers, and the encrypted transmission data is generated using the encryption method of transmission data as described above;

[0162] The data decryption module 53 is used to decrypt the encrypted transmission data using the decryption key value to obtain the original transmission data.

[0163] Optionally, the device further includes a second key-sharing value update module, specifically used for:

[0164] A fourth target security integer is selected from the candidate security integers, and the second master key value is fragmented based on the difference between the second master key value and the fourth target security integer.

[0165] The third target security integer sent by the data sender is obtained, and the second master key value is updated according to the sum between the second master key value fragment and the third target security integer to generate the updated second master key value; wherein, the third target security integer is selected by the data sender from the candidate security integers;

[0166] An updated second key sharing value is generated based on the updated second master key value.

[0167] Optionally, the device further includes a second data deletion module, specifically used for:

[0168] Compare the current time with the data transmission deadline;

[0169] If the current time is the same as the cutoff time, the second master key value and the second key sharing value will be deleted.

[0170] The data decryption device provided in Embodiment 5 of the present invention can execute the data decryption method provided in Embodiment 3 of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0171] Example 6

[0172] Figure 6 A schematic diagram of an electronic device 60 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0173] like Figure 6As shown, the electronic device 60 includes at least one processor 61 and a memory, such as a read-only memory (ROM) 62 and a random access memory (RAM) 63, communicatively connected to the at least one processor 61. The memory stores computer programs executable by the at least one processor. The processor 61 can perform various appropriate actions and processes based on the computer program stored in the ROM 62 or loaded into the RAM 63 from storage unit 68. The RAM 63 may also store various programs and data required for the operation of the electronic device 60. The processor 61, ROM 62, and RAM 63 are interconnected via a bus 64. An input / output (I / O) interface 65 is also connected to the bus 64.

[0174] Multiple components in electronic device 60 are connected to I / O interface 65, including: input unit 66, such as keyboard, mouse, etc.; output unit 67, such as various types of monitors, speakers, etc.; storage unit 68, such as disk, optical disk, etc.; and communication unit 69, such as network card, modem, wireless transceiver, etc. Communication unit 69 allows electronic device 60 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0175] Processor 61 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 61 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 61 performs the various methods and processes described above, such as methods for encrypting and / or decrypting data transmission.

[0176] In some embodiments, the information push processing method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 68. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 60 via ROM 62 and / or communication unit 69. When the computer program is loaded into RAM 63 and executed by processor 61, one or more steps of the encryption and / or decryption methods for transmitting data described above may be performed. Alternatively, in other embodiments, processor 61 may be configured by any other suitable means (e.g., by means of firmware) to perform the encryption and / or decryption methods for transmitting data.

[0177] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0178] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0179] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0180] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0181] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0182] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through a communication network. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0183] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0184] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for encrypting transmitted data, executed by the data sender, comprising: Select a first target secure integer from the candidate secure integers as the first master key value, and generate a first key sharing value based on the first master key value; Based on the second key sharing value and the first key sharing value sent by the data receiving end, an encryption key value is determined, and the original transmitted data is encrypted using the encryption key value to generate encrypted transmitted data; wherein, the second key sharing value is generated based on the second target security integer selected by the data receiving end from the candidate security integers; The encrypted transmission data and the first key sharing value are sent to the data receiving end, so that the data receiving end can decrypt the encrypted transmission data according to the first key sharing value to obtain the original transmission data; In response to a data decryption success signal sent by the data receiving end, a third target security integer is selected from the candidate security integers, and a first master key value fragment is determined based on the difference between the first master key value and the third target security integer, wherein the first master key value fragment is determined by performing a difference operation on the first master key value and the third target security integer; The system obtains the fourth target security integer sent by the data receiving end, and updates the first master key value according to the sum of the first master key value fragment and the fourth target security integer to generate the updated first master key value; wherein, the fourth target security integer is selected by the data receiving end from the candidate security integers; An updated first key sharing value is generated based on the updated first master key value.

2. The method according to claim 1, characterized in that, The step of generating a first key-sharing value based on the first master key value includes: Obtain the target security parameters, and determine the target common parameters from the candidate common parameters based on the correlation between the target security parameters and the candidate common parameters; The generator of the target finite field is obtained from the target common parameters as the first common parameter, and the maximum safe integer corresponding to the candidate safe integer is obtained from the target common parameters as the second common parameter. The first key sharing value is determined based on the first public parameter, the second public parameter, and the first master key value.

3. The method according to claim 2, characterized in that, The step of determining the first key sharing value based on the first public parameter, the second public parameter, and the first master key value includes: The first key-sharing value is determined using the following formula: ； Among them, the This represents the first key sharing value, the This represents the first common parameter, the This represents the second common parameter, the This represents the first master key value.

4. The method according to claim 1, further comprising: Compare the current time with the data transmission deadline; If the current time is the same as the cutoff time, delete the first master key value and the first key sharing value.

5. A method for decrypting transmitted data, executed by a data receiving end, comprising: Select a second target secure integer from the candidate secure integers as the second master key value, and generate a second key sharing value based on the second master key value; The encrypted transmission data sent by the data sender and a first key sharing value are obtained, and a decryption key value is determined based on the first key sharing value and the second key sharing value; wherein, the first key sharing value is generated based on a first target security integer selected by the data sender from the candidate security integers, and the encrypted transmission data is generated using the encryption method for transmission data as described in any one of claims 1 to 4; The encrypted transmission data is decrypted using the decryption key value to obtain the original transmission data; A fourth target security integer is selected from the candidate security integers, and a second master key value fragment is determined based on the difference between the second master key value and the fourth target security integer, wherein the second master key value fragment is determined by performing a difference operation on the second master key value and the fourth target security integer; The third target security integer sent by the data sender is obtained, and the second master key value is updated according to the sum between the second master key value fragment and the third target security integer to generate the updated second master key value; wherein, the third target security integer is selected by the data sender from the candidate security integers; An updated second key sharing value is generated based on the updated second master key value.

6. The method according to claim 5, further comprising: Compare the current time with the data transmission deadline; If the current time is the same as the cutoff time, the second master key value and the second key sharing value will be deleted.

7. A data encryption device, configured at a data sending end, comprising: The first key sharing value generation module is used to select a first target security integer from candidate security integers as a first master key value, and generate a first key sharing value based on the first master key value; An encrypted transmission data generation module is used to determine an encryption key value based on a second key sharing value sent by a data receiving end and a first key sharing value, and to encrypt the original transmission data using the encryption key value to generate encrypted transmission data; wherein, the second key sharing value is generated based on a second target security integer selected by the data receiving end from the candidate security integers; An encrypted data transmission module is used to send the encrypted transmission data and the first key sharing value to the data receiving end, so that the data receiving end can decrypt the encrypted transmission data according to the first key sharing value to obtain the original transmission data; The first key sharing value update module is used for: In response to a data decryption success signal sent by the data receiving end, a third target security integer is selected from the candidate security integers, and a first master key value fragment is determined based on the difference between the first master key value and the third target security integer, wherein the first master key value fragment is determined by performing a difference operation on the first master key value and the third target security integer; The system obtains the fourth target security integer sent by the data receiving end, and updates the first master key value according to the sum of the first master key value fragment and the fourth target security integer to generate the updated first master key value; wherein, the fourth target security integer is selected by the data receiving end from the candidate security integers; An updated first key sharing value is generated based on the updated first master key value.

8. A data decryption device, configured at a data receiving end, comprising: The second key sharing value generation module is used to select a second target security integer from the candidate security integers as the second master key value, and generate a second key sharing value based on the second master key value. The decryption key value determination module is used to obtain the encrypted transmission data sent by the data sending end and the first key sharing value, and determine the decryption key value according to the first key sharing value and the second key sharing value; wherein, the first key sharing value is generated according to the first target security integer selected by the data sending end from the candidate security integers, and the encrypted transmission data is generated using the encryption method for transmission data as described in any one of claims 1 to 4; The data decryption module is used to decrypt the encrypted transmission data using the decryption key value to obtain the original transmission data; The second key sharing value update module is specifically used for: A fourth target security integer is selected from the candidate security integers, and a second master key value fragment is determined based on the difference between the second master key value and the fourth target security integer, wherein the second master key value fragment is determined by performing a difference operation on the second master key value and the fourth target security integer; The third target security integer sent by the data sender is obtained, and the second master key value is updated according to the sum between the second master key value fragment and the third target security integer to generate the updated second master key value; wherein, the third target security integer is selected by the data sender from the candidate security integers; An updated second key sharing value is generated based on the updated second master key value.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-4 and / or 5-6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing a processor to perform the method of any one of claims 1-4 and / or 5-6.

11. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1-4 and / or 5-6.

Images