Data transmission method and device based on multilayer encryption, equipment and medium

Abstract

The invention relates to the technical field of network security, and discloses a data transmission method, device, equipment and medium based on multi-layer encryption, and the method comprises the steps: obtaining target data and a dispersion factor of current encryption, carrying out the key dispersion of a root key of a first encryption algorithm, obtaining a target sub-key, carrying out the primary encryption of the target data, and carrying out the secondary encryption of the target data; obtaining a first ciphertext; the first ciphertext and the target sub-key are encrypted through a public key of a second encryption algorithm, a second ciphertext and a first key envelope are obtained, and the second encryption algorithm is an asymmetric encryption algorithm; and sending the first secret key envelope and the second ciphertext to a data receiving party, so that the data receiving party decrypts the secret key envelope and the second ciphertext according to a private key of a second encryption algorithm to obtain target data. And meanwhile, the subkeys are also encrypted, so that the security in the data transmission process is ensured.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a data transmission method, device, equipment and medium based on multi-layer encryption. Background Art

[0002] With the rapid development of network technology, people's various information activities are increasingly carried out through information systems based on computers and networks, and the value of information is becoming more and more important. This has led to increasingly serious security issues such as data leakage and network attacks, and information security incidents have occurred frequently, causing more or less losses to both enterprises and users. Therefore, in the process of data transmission and storage, how to ensure the security of transmitted data has become increasingly important.

[0003] Existing network security technologies mostly use a single encryption algorithm to encrypt data. Although this improves data security to a certain extent, it is still difficult to effectively guarantee data security during data transmission. Summary of the invention

[0004] In view of this, the present invention provides a data transmission method, device, equipment and medium based on multi-layer encryption to solve the problem that the security of data is still difficult to be effectively guaranteed during the data transmission process.

[0005] In a first aspect, the present invention provides a data transmission method based on multi-layer encryption, which is applied to a data sender, and the method comprises: Obtaining the target data and the dispersion factor of this encryption, and dispersing the root key of the first encryption algorithm by using the dispersion factor to obtain the target subkey; Encrypting the target data once by using the target subkey to obtain a first ciphertext; Encrypt the first ciphertext and the target subkey respectively by using a public key of a second encryption algorithm to obtain a second ciphertext and a first key envelope, wherein the second encryption algorithm is an asymmetric encryption algorithm; The first key envelope and the second ciphertext are sent to the data recipient, the first key envelope is used to enable the data recipient to decrypt the target subkey using the private key of the second encryption algorithm; the second ciphertext is used to enable the data recipient to decrypt the first ciphertext using the private key of the second encryption algorithm.

[0006] The method provided in this aspect disperses the root key through a dispersion factor to obtain a target sub-key, and then encrypts the target data for the first time, and encrypts the first ciphertext after the first encryption for a second time through the public key of an asymmetric algorithm, and encrypts the target sub-key at the same time to obtain a key envelope, and sends the second ciphertext and the key envelope after the second encryption to the data recipient, so that it can decrypt the ciphertext and the target sub-key through a private key and then decrypt it for a second time. The security of the data transmission process is guaranteed by means of multi-layer encryption, and the risk of data leakage is reduced.

[0007] In an optional embodiment, the scatter factor comprises: a scatter sub-factor sequence; The step of dispersing the root key of the first encryption algorithm by using the dispersion factor to obtain the target subkey includes: The root key is sequentially dispersed using each of the dispersed sub-factors in the dispersed sub-factor sequence to obtain a target sub-key.

[0008] In this implementation mode, the root key is dispersed multiple times by using dispersion factors to ensure the difference between the target subkey and the root key, so that even if the subkey is leaked during the transmission process, the root key will not be leaked.

[0009] In an optional embodiment, the method further includes: Splitting the root key into N key components by a threshold algorithm, and distributing the N key components to N security custodians; When the root key is damaged, key components sent by M security custodians are obtained and the root key is restored, where M is less than or equal to N and greater than a preset threshold.

[0010] In this implementation, the root key is split by a threshold algorithm, so that the root key can be repaired in time even if it is damaged, further ensuring the security and stability of the root key.

[0011] In an optional implementation, the first encryption algorithm is a symmetric encryption algorithm; After obtaining the first ciphertext, the method further includes: Encrypting the first ciphertext and the dispersion sub-factor sequence by using a public key of a second encryption algorithm to obtain a third ciphertext; The third ciphertext is sent to a data recipient, and the third ciphertext is used to enable the data recipient to obtain the first ciphertext and the dispersed sub-factor sequence through the private key of the second encryption algorithm, and to obtain the target sub-key through the dispersed sub-factor sequence and the root key of the first encryption algorithm.

[0012] In this embodiment, by setting the first encryption algorithm to a symmetric encryption algorithm, the first ciphertext encrypted by the target sub-key and the dispersed sub-factor sequence used to obtain the target sub-key can be encrypted and sent to the data recipient, so that the data recipient can decrypt the dispersed sub-factor sequence and then disperse it with its own root key to obtain the target sub-key, and then decrypt the first ciphertext to obtain the target data, thereby further ensuring the security of the data transmission process.

[0013] In a second aspect, the present invention provides a data transmission method based on multi-layer encryption, which is applied to a data receiving party, and the method comprises: Obtain a first key envelope and a second ciphertext; Decrypting the first key envelope and the second ciphertext respectively by using a private key of a second encryption algorithm to obtain a target subkey and the first ciphertext, wherein the second encryption algorithm is an asymmetric encryption algorithm; The first ciphertext is decrypted using the target subkey to obtain target data.

[0014] The method provided in this aspect obtains the first ciphertext and the target subkey through the private key of the asymmetric encryption algorithm held by the data recipient, and then decrypts the first ciphertext through the target subkey to obtain the target data, thereby ensuring the security of the data transmission process.

[0015] In an optional implementation, obtaining a third ciphertext; Decrypting the third ciphertext by using the private key of the second encryption algorithm to obtain the first ciphertext and a dispersion sub-factor sequence; Based on the dispersion sub-factor sequence, the root key of the data recipient is dispersed to obtain a target sub-key; The first ciphertext is decrypted using the target subkey to obtain target data.

[0016] In this embodiment, the first ciphertext and the scattered sub-factor sequence are obtained through the private key of the asymmetric encryption algorithm held by the data recipient, and the scattered sub-factor sequence is combined with the root key of the first encryption algorithm held by the data recipient itself to obtain the target sub-key corresponding to the first ciphertext, and then the first ciphertext is decrypted to obtain the target data, thereby further ensuring the security of the data transmission process.

[0017] In a third aspect, the present invention provides a data transmission device based on multi-layer encryption, which is applied to a data sender, and the device comprises: A key dispersion module, used to obtain the target data and the dispersion factor of the current encryption, and to disperse the root key of the first encryption algorithm by the dispersion factor to obtain the target subkey; A first encryption module, used to encrypt the target data once using the target subkey to obtain a first ciphertext; A second encryption module, used to encrypt the first ciphertext and the target subkey respectively by using a public key of a second encryption algorithm to obtain a second ciphertext and a first key envelope, wherein the second encryption algorithm is an asymmetric encryption algorithm; A data sending module is used to send the first key envelope and the second ciphertext to a data recipient, wherein the first key envelope is used to enable the data recipient to decrypt the target subkey using the private key of the second encryption algorithm; and the second ciphertext is used to enable the data recipient to decrypt the first ciphertext using the private key of the second encryption algorithm.

[0018] In a fourth aspect, the present invention provides a data transmission device based on multi-layer encryption, which is applied to a data receiving party, and the device includes: A data receiving module, used to obtain a first key envelope and a second ciphertext; A first decryption module, used to decrypt the first key envelope and the second ciphertext respectively by using a private key of a second encryption algorithm to obtain a target subkey and the first ciphertext, wherein the second encryption algorithm is an asymmetric encryption algorithm; The second decryption module is used to decrypt the first ciphertext using the target subkey to obtain target data.

[0019] In a fifth aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the data transmission method based on multi-layer encryption of any of the above aspects or any corresponding implementation methods thereof by executing the computer instructions.

[0020] In a sixth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the data transmission method based on multi-layer encryption of any of the above aspects or any of its corresponding embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 is a flowchart of a multi-layer encryption-based data transmission method applied to a data sender according to an embodiment of the present invention; Figure 2 is a flow chart of another multi-layer encryption-based data transmission method applied to a data sender according to an embodiment of the present invention; Figure 3 is a flowchart of a multi-layer encryption-based data transmission method applied to a data receiving party according to an embodiment of the present invention; Figure 4 is a flow chart of another multi-layer encryption-based data transmission method applied to a data receiving party according to an embodiment of the present invention; Figure 5 is a structural block diagram of a data transmission device based on multi-layer encryption applied to a data sender according to an embodiment of the present invention; Figure 6 is a structural block diagram of a data transmission device based on multi-layer encryption applied to a data receiving party according to an embodiment of the present invention; Figure 7 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0024] With the rapid development of network technology, people's various information activities are increasingly carried out through information systems based on computers and networks, and the value of information is becoming more and more important. This has led to increasingly serious security issues such as data leakage and network attacks, and information security incidents have occurred frequently, causing more or less losses to both enterprises and users. Therefore, in the process of data transmission and storage, how to ensure the security of transmitted data has become increasingly important.

[0025] Existing network security technologies mostly use a single encryption algorithm to encrypt data. Although this improves data security to a certain extent, it is still difficult to effectively guarantee data security during data transmission.

[0026] To this end, an embodiment of the present invention provides a data transmission method based on multi-layer encryption, which is applied to the data sender, disperses the root key through a dispersion factor to obtain a target sub-key, and then encrypts the target data for the first time, and encrypts the first ciphertext after the first encryption for a second time through the public key of an asymmetric algorithm, and encrypts the target sub-key at the same time to obtain a key envelope, and sends the second ciphertext and the key envelope after the second encryption to the data recipient, so that it can decrypt the ciphertext and the target sub-key through a private key and then decrypt it for the second time. The security of the data transmission process is guaranteed by means of multi-layer encryption, and the risk of data leakage is reduced.

[0027] According to an embodiment of the present invention, an embodiment of a data transmission method based on multi-layer encryption is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0028] In this embodiment, a data transmission method based on multi-layer encryption is provided, which can be used by the data sender during the above-mentioned data encryption transmission. Figure 1 is a flow chart of a data transmission method based on multi-layer encryption applied to a data sender according to an embodiment of the present invention, such as Figure 1 As shown, the process includes the following steps: Step S101, obtaining target data and a dispersion factor for this encryption, and dispersing a root key of a first encryption algorithm by using the dispersion factor to obtain a target subkey.

[0029] First, obtain the target data that needs to be encrypted for this data transmission, as well as the dispersion factor used to disperse the key. The dispersion factor can be understood as the introduction of additional variables, such as serial number, terminal number and other information, to disperse the root key of an encryption algorithm. The root key can be understood as the most original key of an encryption algorithm, that is, the key that has not been dispersed.

[0030] The root key can be dispersed by a dispersion factor through a specific key derivation function to derive a subkey. The root key can be derived in multiple rounds according to the actual situation. Here, illustratively, a subkey derived once is used as the target subkey for subsequent encryption of target data. For specific key derivation and dispersion factor related technologies, please refer to the relevant technical means, which will not be repeated here.

[0031] Step S102: encrypt the target data once using the target subkey to obtain a first ciphertext.

[0032] After obtaining the target subkey, the target data that the data sender wants to transmit is encrypted using the target subkey to obtain the first ciphertext, that is, the ciphertext encrypted using the target subkey.

[0033] Step S103: Encrypt the first ciphertext and the target subkey respectively by using the public key of the second encryption algorithm to obtain the second ciphertext and the first key envelope, and the second encryption algorithm is an asymmetric encryption algorithm.

[0034] Then, the target subkey obtained by the dispersion in the above step S101 is encrypted by the public key of the second encryption algorithm to obtain the first key envelope, that is, the encrypted target subkey. At the same time, the first ciphertext obtained in the above step S102 is encrypted by the public key of the second encryption algorithm to obtain the second ciphertext. The second ciphertext at this time is equivalent to the ciphertext data after the target data is encrypted by the target subkey and the public key of the second encryption algorithm. The second encryption algorithm is an asymmetric encryption algorithm. For the data sender, there is only the public key of the asymmetric encryption algorithm. For the data receiver, there is the private key of the asymmetric encryption algorithm, so that the data receiver can perform the corresponding decryption operation.

[0035] Step S104, sending the first key envelope and the second ciphertext to the data recipient, the first key envelope is used to enable the data recipient to decrypt using the private key of the second encryption algorithm to obtain the target subkey; the second ciphertext is used to enable the data recipient to decrypt using the private key of the second encryption algorithm to obtain the first ciphertext.

[0036] After obtaining the first key envelope and the second ciphertext, the first key envelope and the second ciphertext are sent to the data receiver. To further ensure the security of data transmission, the first key envelope and the second ciphertext may be transmitted successively.

[0037] As mentioned in the above content, the second encryption algorithm is an asymmetric encryption algorithm. Therefore, as the data recipient, the private key of the algorithm will be held. The data recipient can use the private key held by itself to decrypt the first key envelope and the second ciphertext respectively to obtain the target sub-key and the first ciphertext, and then decrypt the first ciphertext with the decrypted target sub-key to obtain the target data.

[0038] The data transmission method based on multi-layer encryption provided in this embodiment is applied to the data sender, which disperses the root key through the dispersion factor to obtain the target sub-key, and then encrypts the target data for the first time, and encrypts the first ciphertext after the first encryption for the second time through the public key of the asymmetric algorithm, and encrypts the target sub-key at the same time to obtain a key envelope, and sends the second ciphertext and the key envelope after the second encryption to the data recipient, so that it can decrypt the ciphertext and the target sub-key through the private key and then decrypt it for the second time. The security of the data transmission process is guaranteed by means of multi-layer encryption, and the risk of data leakage is reduced.

[0039] According to an embodiment of the present invention, another data transmission method embodiment based on multi-layer encryption is provided, which is also applied to the data sender during the above data encryption transmission. Figure 2 is a flowchart of another data transmission method based on multi-layer encryption applied to a data sender according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps: Step S201, obtaining target data and a dispersion factor for this encryption, and dispersing a root key of a first encryption algorithm by using the dispersion factor to obtain a target subkey.

[0040] Specifically, the dispersion factor includes: a dispersion sub-factor sequence; In the above step S201, the root key of the first encryption algorithm is dispersed by the dispersion factor to obtain the target subkey including: The root key is dispersed in turn using each dispersion sub-factor in the dispersion sub-factor sequence to obtain the target sub-key.

[0041] It can be understood that the dispersion factor is a dispersion sub-factor sequence, which contains multiple dispersion sub-factors, and each dispersion sub-factor has a corresponding order. When the root key is dispersed, the root key can be dispersed for multiple rounds by using each dispersion sub-factor in sequence based on the order of each dispersion sub-factor. For example: the dispersion sub-factor sequence includes: "1: dispersion information 1", "2: dispersion information 2", "3: dispersion information 3". Then, the root key can be dispersed for the first time by dispersion information 1 and the key derivation algorithm to obtain the first sub-key; then the root key can be dispersed for the second time by dispersion information 2 and the key derivation algorithm to obtain the second sub-key, and so on, until the multiple rounds of key dispersion of the root key are completed.

[0042] Step S202: encrypt the target data once using the target subkey to obtain the first ciphertext. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0043] Specifically, the first encryption algorithm is a symmetric encryption algorithm.

[0044] It can be understood that when the first encryption algorithm is a symmetric encryption algorithm, it means that both parties of data transmission hold the root key of the first encryption algorithm, so that the subsequent data recipient can obtain the target sub-key through the dispersed sub-factor sequence.

[0045] Step S203: encrypt the first ciphertext and the dispersion sub-factor sequence by using the public key of the second encryption algorithm to obtain a third ciphertext.

[0046] It can be understood that Figure 2 The embodiment shown starts from step S203, which is equivalent to Figure 1 In the embodiment shown, the root key is dispersed to obtain the target sub-key and another encryption transmission method is used based on the first encryption of the target data. When encrypting and transmitting data in practice, the user can choose to adopt a specific encryption transmission method based on the actual situation.

[0047] For step S203, it can be understood that after obtaining the first ciphertext encrypted by the target subkey, the first ciphertext and the dispersed sub-factor sequence are encrypted by the second encryption algorithm, that is, the asymmetric encryption algorithm, to obtain the third ciphertext. Specifically, when encrypting, the first ciphertext and the dispersed sub-factor sequence can be packaged and encrypted to obtain the third ciphertext; or they can be encrypted separately and transmitted to the data recipient separately. For ease of understanding, this embodiment adopts a packaged encryption method, that is, the user can directly obtain the first ciphertext and the dispersed sub-factor sequence after decrypting the third ciphertext.

[0048] It should be noted that for Figure 2 In the illustrated embodiment, on the basis that the first encryption algorithm is a symmetric encryption algorithm, that is, in the scenario of symmetric encryption, the data sender and the data receiver usually pre-agreed on a key derivation function for key dispersion of the root key, so as to ensure that the data receiver can obtain the target subkey according to the root key, the dispersion factor sequence and the key derivation function. Exemplarily, the key derivation function can be implemented by a hash function or other key derivation algorithms. For example, HMAC - Key Derivation Function (HKDF) is used, which is not limited here.

[0049] In some cases, if the two parties have not agreed on a key derivation function, the key derivation function can be encrypted by a second encryption algorithm and sent to the data recipient so that it can obtain the specific key derivation function and then obtain the target subkey.

[0050] Step S204, sending the third ciphertext to the data recipient, the third ciphertext is used to enable the data recipient to obtain the first ciphertext and the scattered sub-factor sequence through the private key of the second encryption algorithm, and to obtain the target sub-key through the scattered sub-factor sequence and the root key of the first encryption algorithm.

[0051] After obtaining the third ciphertext in the above step S203, the third ciphertext can be sent to the data recipient. Since the second encryption algorithm corresponding to the third ciphertext is an asymmetric encryption algorithm, the data recipient holds the private key of the second encryption algorithm and can decrypt the third ciphertext to obtain the first ciphertext and the dispersed sub-factor sequence. At the same time, since the first encryption algorithm is a symmetric encryption algorithm and both parties hold a specific key derivation function, the data recipient can obtain a specific target sub-key, and then decrypt the first ciphertext to obtain the target data.

[0052] Specifically, in one example, the method further includes: splitting the root key into N key components by a threshold algorithm, and distributing the N key components to N security custodians; When the root key is damaged, obtain the key components sent by M security custodians and restore the root key, where M is less than or equal to N and greater than a preset threshold.

[0053] It can be understood that the threshold algorithm is a key sharing scheme that allows a secret (such as a key) to be split into multiple shares, so that the original key can only be recovered when a sufficient number (threshold) of shares are combined together. For example, if a key is split into 5 shares and the threshold value is set to 3, the key can only be recovered when at least 3 shares are correctly combined.

[0054] Purpose: This algorithm is mainly used to improve the security and availability of keys. By dispersing the storage of keys, the risk of security incidents caused by key leakage at a single storage point is reduced. At the same time, even if some shares are lost or damaged, the key can still be recovered as long as the number of remaining shares reaches the threshold.

[0055] The data transmission method based on multi-layer encryption applied to the data sender provided by the above-mentioned embodiment of the present invention sets the first encryption algorithm as a symmetric encryption algorithm, so that the first ciphertext encrypted by the target sub-key and the scattered sub-factor sequence used to obtain the target sub-key can be encrypted and sent to the data receiver, so that the data receiver can obtain the scattered sub-factor sequence after decryption, and then disperse it with its own root key to obtain the target sub-key, and then decrypt the first ciphertext to obtain the target data, thereby further ensuring the security of the data transmission process.

[0056] According to an embodiment of the present invention, there is provided Figure 1An embodiment of a data transmission method based on multi-layer encryption corresponding to the embodiment shown is applied to the data receiving party during the above data encryption transmission. Figure 3 is a flow chart of a data transmission method based on multi-layer encryption applied to a data receiving party according to an embodiment of the present invention, such as Figure 3 As shown, the process includes the following steps: Step S301, obtaining a first key envelope and a second ciphertext.

[0057] That is, the data receiver obtains the first key envelope and the second ciphertext from the data sender.

[0058] Step S302: Decrypt the first key envelope and the second ciphertext respectively using the private key of the second encryption algorithm to obtain the target subkey and the first ciphertext. The second encryption algorithm is an asymmetric encryption algorithm.

[0059] The target subkey and the first ciphertext can be obtained by decrypting the first key envelope and the second ciphertext using the private key of the second encryption algorithm, which is an asymmetric encryption algorithm, held by the data recipient.

[0060] Step S303: decrypt the first ciphertext using the target subkey to obtain target data.

[0061] Since the first ciphertext is encrypted by using the target subkey, the data receiver can obtain the target data sent by the data sender by decrypting the first ciphertext using the target subkey.

[0062] The present invention Figure 3 The illustrated embodiment provides a data transmission method based on multi-layer encryption applied to a data recipient, which obtains a first ciphertext and a target subkey through a private key of an asymmetric encryption algorithm held by the data recipient, and then decrypts the first ciphertext through the target subkey to obtain the target data, thereby ensuring the security of the data transmission process.

[0063] According to an embodiment of the present invention, there is provided Figure 2 An embodiment of a data transmission method based on multi-layer encryption corresponding to the embodiment shown is applied to the data receiving party during the above data encryption transmission. Figure 4 is a flowchart of another data transmission method based on multi-layer encryption applied to a data receiving party according to an embodiment of the present invention. Figure 4 As shown, the process includes the following steps: Step S401, obtaining a third ciphertext.

[0064] The data sender receives the data through Figure 2 The third ciphertext sent according to the specific content of the illustrated embodiment.

[0065] Step S402: decrypt the third ciphertext using the private key of the second encryption algorithm to obtain the first ciphertext and a dispersion sub-factor sequence.

[0066] Similarly, the third ciphertext can be decrypted using the private key of the second encryption algorithm, an asymmetric encryption algorithm, held by the data recipient, to obtain the first ciphertext and the dispersion sub-factor sequence.

[0067] In some cases, the data sender can encrypt and send the first ciphertext and the dispersion factor sequence separately, and the data receiver can decrypt them separately.

[0068] Step S403: Based on the dispersed sub-factor sequence, the root key of the data receiver is dispersed to obtain a target sub-key.

[0069] For the first encryption algorithm, which is a symmetric encryption algorithm, both the data receiver and the data sender hold their root key, and both parties know the specific key derivation function. The data receiver can obtain the target subkey by performing multiple rounds of dispersion on the root key through the key derivation function and the dispersion subfactor sequence.

[0070] Step S404: decrypt the first ciphertext using the target subkey to obtain target data.

[0071] After obtaining the target subkey, the first ciphertext is decrypted to obtain the target data.

[0072] The present invention Figure 4 The embodiment provides a data transmission method based on multi-layer encryption applied to a data recipient, which obtains a first ciphertext and a scattered sub-factor sequence through a private key of a non-symmetric encryption algorithm held by the data recipient, combines the scattered sub-factor sequence with a root key of the first encryption algorithm held by the data recipient itself, obtains a target sub-key corresponding to the first ciphertext, and then decrypts the first ciphertext to obtain the target data, thereby further ensuring the security of the data transmission process.

[0073] The above method embodiment involves multiple encryption processes on the same data, and each encryption uses a different key or algorithm, thereby significantly increasing the difficulty of data cracking. This technology effectively resists various network attacks by increasing the complexity of the key and the number of encryption layers, and protects the confidentiality and integrity of the data during transmission and storage. Regarding the encryption algorithm combination strategy involved in the above method embodiment: the present invention uses a variety of encryption algorithms for combined use, including but not limited to symmetric encryption algorithms (such as AES, SM4), asymmetric encryption algorithms (such as RSA, SM2), hash algorithms (such as SHA-256, SM3), etc. According to the different characteristics and application scenarios of the data, these algorithms are flexibly selected and combined to form a multi-level and multi-dimensional encryption protection system.

[0074] Furthermore, in the process of implementing the above method embodiment, while ensuring encryption security, the encryption process can also reduce the consumption of system resources and improve encryption efficiency by optimizing algorithm parameters and using hardware acceleration.

[0075] In the present embodiment, a data transmission device based on multi-layer encryption is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions thereof will not be repeated. As used below, the term "module" may implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and contemplated.

[0076] This embodiment provides a data transmission device based on multi-layer encryption for use by a data sender, such as Figure 5 As shown, including: The key dispersion module 501 is used to obtain the target data and the dispersion factor of the current encryption, and to disperse the root key of the first encryption algorithm by the dispersion factor to obtain the target subkey; The first encryption module 502 is used to encrypt the target data once using the target subkey to obtain a first ciphertext; A second encryption module 503 is used to encrypt the first ciphertext and the target subkey respectively by using a public key of a second encryption algorithm to obtain a second ciphertext and a first key envelope, wherein the second encryption algorithm is an asymmetric encryption algorithm; The data sending module 504 is used to send a first key envelope and a second ciphertext to a data recipient. The first key envelope is used to enable the data recipient to decrypt the target subkey using the private key of the second encryption algorithm; the second ciphertext is used to enable the data recipient to decrypt the first ciphertext using the private key of the second encryption algorithm.

[0077] In some optional embodiments, the scatter factor comprises: a scatter sub-factor sequence; The key dispersing module 501, when dispersing the root key of the first encryption algorithm by using the dispersing factor to obtain the target subkey, includes: The root key is dispersed in turn using each dispersion sub-factor in the dispersion sub-factor sequence to obtain the target sub-key.

[0078] In an optional embodiment, the apparatus is further used to split the root key into N key components by a threshold algorithm, and distribute the N key components to N security custodians; When the root key is damaged, obtain the key components sent by M security custodians and restore the root key, where M is less than or equal to N and greater than a preset threshold.

[0079] In an optional implementation, the first encryption algorithm is a symmetric encryption algorithm; After obtaining the first ciphertext, the second encryption module 503 is further used to encrypt the first ciphertext and the dispersion sub-factor sequence by using the public key of the second encryption algorithm to obtain a third ciphertext; The data sending module 504 is also used to send the third ciphertext to the data recipient, and the third ciphertext is used to enable the data recipient to obtain the first ciphertext and the scattered sub-factor sequence through the private key of the second encryption algorithm, and to obtain the target sub-key through the scattered sub-factor sequence and the root key of the first encryption algorithm.

[0080] This embodiment provides a data transmission device based on multi-layer encryption for use at a data receiving party, such as Figure 6 As shown, including: A data receiving module 601 is used to obtain a first key envelope and a second ciphertext; A first decryption module 602 is used to decrypt the first key envelope and the second ciphertext respectively by using a private key of a second encryption algorithm to obtain a target subkey and the first ciphertext, where the second encryption algorithm is an asymmetric encryption algorithm; The second decryption module 603 is used to decrypt the first ciphertext using the target subkey to obtain target data.

[0081] In an optional implementation, the data receiving module 601 is further used to obtain a third ciphertext.

[0082] The first decryption module 602 is further used to decrypt the third ciphertext using the private key of the second encryption algorithm to obtain the first ciphertext and the dispersion sub-factor sequence; Based on the dispersed sub-factor sequence, the root key of the data receiver is dispersed to obtain the target sub-key; The second decryption module 603 is used to decrypt the first ciphertext using the target subkey to obtain target data.

[0083] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0084] The data transmission device based on multi-layer encryption in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0085] The embodiment of the present invention also provides a computer device having the above Figure 5 or Figure 6 The data transmission device shown is based on multi-layer encryption.

[0086] See also Figure 7 , Figure 7 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 7 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 7 A processor 10 is taken as an example.

[0087] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0088] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0089] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0090] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0091] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 7 The example of connecting through bus is taken in the following.

[0092] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device may be a touch screen.

[0093] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0094] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A data transmission method based on multi-layer encryption, applied to a data sender, characterized in that: The method comprises: Obtaining the target data and the dispersion factor of this encryption, and dispersing the root key of the first encryption algorithm by using the dispersion factor to obtain the target subkey; Encrypting the target data once by using the target subkey to obtain a first ciphertext; Encrypt the first ciphertext and the target subkey respectively by using a public key of a second encryption algorithm to obtain a second ciphertext and a first key envelope, wherein the second encryption algorithm is an asymmetric encryption algorithm; The first key envelope and the second ciphertext are sent to the data recipient, the first key envelope is used to enable the data recipient to decrypt the target subkey using the private key of the second encryption algorithm; the second ciphertext is used to enable the data recipient to decrypt the first ciphertext using the private key of the second encryption algorithm.

2. The method according to claim 1, characterized in that: The scatter factor comprises: a scatter sub-factor sequence; The step of dispersing the root key of the first encryption algorithm by using the dispersion factor to obtain the target subkey includes: The root key is sequentially dispersed using each of the dispersed sub-factors in the dispersed sub-factor sequence to obtain a target sub-key.

3. The method according to claim 1, characterized in that The method further comprises: Splitting the root key into N key components by a threshold algorithm, and distributing the N key components to N security custodians; When the root key is damaged, key components sent by M security custodians are obtained and the root key is restored, where M is less than or equal to N and greater than a preset threshold.

4. The method according to claim 2, characterized in that: The first encryption algorithm is a symmetric encryption algorithm; After obtaining the first ciphertext, the method further includes: Encrypting the first ciphertext and the dispersion sub-factor sequence by using a public key of a second encryption algorithm to obtain a third ciphertext; The third ciphertext is sent to a data recipient, and the third ciphertext is used to enable the data recipient to obtain the first ciphertext and the dispersed sub-factor sequence through the private key of the second encryption algorithm, and to obtain the target sub-key through the dispersed sub-factor sequence and the root key of the first encryption algorithm.

5. A data transmission method based on multi-layer encryption, applied to a data receiver, characterized in that: The method comprises: Obtain a first key envelope and a second ciphertext; Decrypting the first key envelope and the second ciphertext respectively by using a private key of a second encryption algorithm to obtain a target subkey and the first ciphertext, wherein the second encryption algorithm is an asymmetric encryption algorithm; The first ciphertext is decrypted using the target subkey to obtain target data.

6. The method according to claim 5, characterized in that The method further comprises: Get the third ciphertext; Decrypting the third ciphertext by using the private key of the second encryption algorithm to obtain the first ciphertext and a dispersion sub-factor sequence; Based on the dispersion sub-factor sequence, the root key of the data recipient is dispersed to obtain a target sub-key; The first ciphertext is decrypted using the target subkey to obtain target data.

7. A data transmission device based on multi-layer encryption, applied to a data sender, characterized in that: The device comprises: A key dispersion module, used to obtain the target data and the dispersion factor of the current encryption, and to disperse the root key of the first encryption algorithm by the dispersion factor to obtain the target subkey; A first encryption module, used to encrypt the target data once using the target subkey to obtain a first ciphertext; A second encryption module, used to encrypt the first ciphertext and the target subkey respectively by using a public key of a second encryption algorithm to obtain a second ciphertext and a first key envelope, wherein the second encryption algorithm is an asymmetric encryption algorithm; A data sending module is used to send the first key envelope and the second ciphertext to a data recipient, wherein the first key envelope is used to enable the data recipient to decrypt the target subkey using the private key of the second encryption algorithm; and the second ciphertext is used to enable the data recipient to decrypt the first ciphertext using the private key of the second encryption algorithm.

8. A data transmission device based on multi-layer encryption, applied to a data receiver, characterized in that: The device comprises: A data receiving module, used to obtain a first key envelope and a second ciphertext; A first decryption module, used to decrypt the first key envelope and the second ciphertext respectively by using a private key of a second encryption algorithm to obtain a target subkey and the first ciphertext, wherein the second encryption algorithm is an asymmetric encryption algorithm; The second decryption module is used to decrypt the first ciphertext using the target subkey to obtain target data.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the data transmission method based on multi-layer encryption according to any one of claims 1 to 6 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the data transmission method based on multi-layer encryption according to any one of claims 1 to 6.

Images