Data transmission method, data receiving method, medium and program product

Abstract

The invention is suitable for the technical field of communication, and provides a data transmission method, a data receiving method, a medium and a program product, the data transmission method comprises the following steps: receiving first plaintext data sent by a sending end, and determining a first data abstract of the first plaintext data; determining data of a preset data size from the first data abstract as a target key; encrypting the first data abstract and the first plaintext data based on the target key to obtain ciphertext data; encrypting the target key based on the target key to obtain a digital signature corresponding to the first plaintext data; the ciphertext data and the digital signature are sent to a receiving end, the receiving end obtains a target key under the condition that the ciphertext data and the digital signature are received, verifies the data signature based on the target key, decrypts the ciphertext to obtain first plaintext data based on a decryption result and the first data abstract under the condition that the digital signature verification is passed, and sends the first plaintext data to the receiving end; and the data transmission efficiency is ensured while secure data transmission is realized.

Description

Technical Field

[0001] The present application belongs to the field of communication technology, and in particular, relates to a data transmission method, a data receiving method, a medium and a program product. Background Art

[0002] Secure data transmission aims to convert original data into ciphertext form through a specific encryption algorithm, so that only the authorized party with the correct decryption key can restore it to the original data, thereby effectively preventing the data from being stolen or tampered with during transmission.

[0003] At present, the commonly used data security transmission method is usually asymmetric encryption transmission. Asymmetric encryption transmission requires the key generation algorithm to generate public keys and private keys through complex data processing processes, so that the public keys and private keys can be used together to authenticate data signatures, etc. However, the asymmetric encryption algorithms involved in the data encryption and decryption process are usually more complex, resulting in relatively slow data encryption and decryption speeds. In addition, the public key needs to be managed, which increases the complexity of data security transmission.

[0004] Therefore, how to achieve secure data transmission while ensuring data transmission efficiency has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The embodiments of the present application provide a data transmission method, a data receiving method, a medium and a program product, which can solve the problem of how to achieve secure data transmission while ensuring data transmission efficiency.

[0006] In a first aspect, an embodiment of the present application provides a data transmission method, which is applied to an authentication end, and the method includes: receiving first plaintext data sent by a sending end, and determining a first data summary of the first plaintext data; Determine a preset amount of data from the first data digest as a target key; Encrypt the first data digest and the first plaintext data based on the target key to obtain ciphertext data; Encrypting the target key based on the target key to obtain a digital signature corresponding to the first plaintext data; The ciphertext data and the digital signature are sent to the receiving end. The receiving end obtains the target key when receiving the ciphertext data and the digital signature, verifies the data signature based on the target key, and decrypts the ciphertext data based on the target key to obtain the first data summary when the digital signature verification passes, and obtains the first plaintext data based on the decryption result of the ciphertext data and the first data summary.

[0007] In the above technical solution, the plaintext data sent by the sender is encrypted and forwarded to the receiver through the authentication end, and the authentication end also generates a digital signature corresponding to the plaintext data and sends the digital signature to the receiver. In this way, the receiver can double-verify the received data through the digital signature and the ciphertext data, determine the security and reliability of the data, and realize the secure transmission of the data. The key used by the authentication end is part of the data determined from the data summary of the plaintext data. Different keys can be obtained for the plaintext data sent by different senders. There is no need to generate different keys for different communication parties through the key generation algorithm, and there is no need to issue and manage the keys, which greatly reduces the workload on key generation and management. And the authentication end encrypts the data and obtains the digital signature through the same key, and there is no need to encrypt the data and generate the digital signature based on different keys as in the traditional data transmission scheme, thereby speeding up the data transmission efficiency. In addition, the receiver will obtain the same key to verify the digital signature and decrypt the ciphertext data, and there is no need to encrypt and decrypt the data and digital signature based on different private keys and public keys, thereby reducing the complexity of data processing and algorithms during data transmission, and improving the data transmission efficiency.

[0008] In some embodiments, encrypting the first data digest and the first plaintext data based on the target key to obtain ciphertext data includes: Based on a preset data length, dividing the first data summary and the first plaintext data into at least one data block; Based on the preset encryption algorithm and the target key, each data block is encrypted to obtain the sub-encryption result corresponding to each data block; Combine each sub-encryption result to get the ciphertext data.

[0009] In the above technical solution, by dividing the summary data and the plaintext data into data blocks, block encryption of the summary data and the plaintext data is achieved, which can speed up the encryption efficiency when the total amount of plaintext data is large, thereby improving the efficiency of data security transmission.

[0010] In some embodiments, after the ciphertext data and the digital signature are sent to the receiving end, the method further includes: When receiving a request to obtain the target key sent by the receiving end, the target key is sent to the receiving end.

[0011] In the above technical solution, the target key and the ciphertext data are sent to the receiving end separately, which can reduce the probability of the target key and the ciphertext data being intercepted together, thereby improving the security of data transmission.

[0012] In some embodiments, before sending the ciphertext data and the digital signature to the receiving end, the method further includes: The target key is sent to the sending end, and when the sending end receives the key acquisition request sent by the receiving end, it sends the target key to the receiving end.

[0013] In the above technical solution, after the target key is sent to the sending end, the receiving end can also request the target key from the sending end, so that the receiving end has multiple ways to obtain the key.

[0014] In some embodiments, before determining the first data digest of the first plaintext data, the method further includes: Performing a data preprocessing operation on the first plaintext data; the data preprocessing operation includes at least one of cleaning data, converting data format, discretizing continuous variables, classifying data, or integrating data; Determining a first data digest of the first plaintext data includes: Based on a preset hash function, a first data digest of the processed first plaintext data is determined.

[0015] In the above technical scheme, the original data, that is, the first plaintext data, can be cleaned, converted, normalized, classified and / or variable discretized through data preprocessing operations, which can effectively remove errors and redundant parts in the first plaintext data, unify the data format and classify the data, improve the reliability of the data and reduce the total amount of data, and speed up the efficiency of subsequent data encryption.

[0016] In a second aspect, the present application provides a data receiving method, applied to a receiving end, the method comprising: When receiving the ciphertext data and the digital signature, a target key is obtained, where the target key is data of a preset data amount determined by the authentication end from the first data digest, where the first data digest is a data digest of the first plaintext data; the first plaintext data is data sent by the sending end to the authentication end, the ciphertext data is obtained by the authentication end encrypting the first data digest and the first plaintext data based on the target key, and the digital signature is obtained by the authentication end encrypting the target key based on the target key; Verify the digital signature based on the target key; When the digital signature verification is passed, the ciphertext data is decrypted based on the target key to obtain a first data summary; The first plaintext data is obtained based on the decryption result of the ciphertext data and the first data summary.

[0017] In the above technical solution, the ciphertext data received by the receiving end is the data obtained by encrypting the plaintext data and the data summary by the authentication end based on the target key, and the digital signature is the data obtained by the authentication end after encrypting the device itself based on the target key. In this way, after the receiving end decrypts the digital signature, it can verify the digital signature by comparing the decrypted result of the digital signature with the target key. There is no need to verify the digital signature through complex exponential, logarithmic and modulus operations like traditional asymmetric encryption, which improves the verification efficiency of the digital signature. And after the signature verification is passed, the receiving end is also required to obtain the plaintext data based on the decryption result and the data summary, so as to achieve the purpose of double verification of the data and improve the security and reliability of the data. In addition, the keys used by the receiving end and the authentication end are both data of a preset data amount determined from the data summary, realizing symmetric encryption operations based on a unified key, combining double data verification with symmetric encryption, and there is no need to use asymmetric encryption algorithms to improve the efficiency of secure data transmission.

[0018] In some embodiments, obtaining the first plaintext data based on the decryption result of the ciphertext data and the first data summary includes: Determine a second data digest corresponding to the plaintext data in the decryption result; When the second data digest matches the first data digest, the plaintext data in the decryption result is determined to be the first plaintext data, and the first plaintext data is stored.

[0019] In the above technical solution, the second data digest corresponding to the plaintext data in the decryption result is re-determined, and the second data digest is compared with the first data digest, so as to realize the verification of data integrity.

[0020] In some embodiments, verifying the digital signature based on the target key includes: Decrypt the digital signature based on the target key to obtain a decrypted signature; Compare the decrypted signature with the target key; When the decrypted signature matches the target key, it is determined that the digital signature verification has passed; In the case where the decrypted signature does not match the target key, it is determined that the digital signature verification has failed.

[0021] In the above technical solution, when the receiving end digitally verifies the signature, it decrypts the digital signature through the target key that is the same as that used when the authenticating end generated the digital signature, and obtains the verification result based on a simple comparison of the target key and the decrypted signature. There is no need to verify the signature based on private keys, public keys and complex data processing processes as in traditional asymmetric encryption transmission. While simplifying the digital signature verification process, it can also speed up the digital verification process, thereby improving the efficiency of secure data transmission.

[0022] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the data transmission method in any embodiment of the first aspect or the data receiving method in any embodiment of the second aspect includes: In a fourth aspect, an embodiment of the present application provides a computer program product. When the computer program product is run, the data transmission method in any embodiment of the first aspect or the data receiving method in any embodiment of the second aspect is executed.

[0023] In a fifth aspect, an embodiment of the present application provides an authentication end, which includes: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the data transmission method in any embodiment of the first aspect when executing the computer program. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0025] Figure 1 It is a schematic diagram of the process of providing traditional asymmetric encryption transmission in an embodiment of the present application; Figure 2 It is a flowchart of a data transmission method provided by an embodiment of the present application; Figure 3 It is a workflow diagram of a data transmission method in a substation in an application scenario; Figure 4 is a flowchart of another data transmission method provided in an embodiment of the present application; Figure 5 It is a flowchart of a data receiving method provided by an embodiment of the present application; Figure 6 It is a structural diagram of an authentication terminal provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0027] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0028] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0029] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0030] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0031] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0032] Figure 1 This is a flow chart of traditional asymmetric encryption transmission, such as Figure 1As shown in the figure, before data transmission, the public key infrastructure (PKI) generates a public key based on a complex key generation algorithm and sends it to the sender and the receiver. The receiver and the sender each generate a private key based on a complex key generation algorithm and save it. During data transmission, the sender determines the hash value of the original data, encrypts the hash value based on its own private key 1 and the asymmetric encryption algorithm to generate a data signature, and uses the public key and the asymmetric encryption algorithm to encrypt the original data to obtain the ciphertext, and sends the digital signature and ciphertext to the receiver. The receiver decrypts the ciphertext based on its own secret key 2 and the asymmetric encryption algorithm, and decrypts the digital signature based on the public key and the asymmetric encryption algorithm to verify the data signature, thereby confirming whether the original data has been tampered with. However, this transmission method requires at least three keys to be generated and the two communicating parties use asymmetric encryption algorithms to encrypt and decrypt data through different keys and complex data processing processes, which makes the efficiency of key generation and data encryption and decryption slow. Especially when processing large-scale data transmission, this inefficiency problem is more prominent, seriously affecting the efficiency of data transmission.

[0033] In view of the above problems, the embodiments of the present application provide a data transmission method, a data receiving method, a medium and a program product, which involve encrypted data, data digest and data signature in the data transmission process, so that the receiver with the correct key can double-verify the data signature and data digest after receiving the data, realize the unification of identity authentication and integrity verification, and improve the security of data transmission. In addition, in the process of generating data signature and encrypting data, part of the data in the data digest is used as the key, without the need to generate and manage the key through the key generation algorithm, simplifying the key generation and encryption and decryption process in the data transmission process, and improving the efficiency of data transmission.

[0034] Combine the following Figure 2 The data transmission method in the embodiment of the present application is introduced in detail.

[0035] Figure 2 is a flow chart of a data transmission method provided by an embodiment of the present application, such as Figure 2 The method is applied to the authentication end, and the method includes the following steps: Step S101, receiving first plaintext data sent by a sending end, and determining a first data summary of the first plaintext data.

[0036] In this embodiment, the authentication end can be a gateway, server, desktop computer, laptop computer, ultra-mobile personal computer (UMPC) and other electronic devices. The embodiment of the present application does not impose any restrictions on the specific type of electronic device. The sending end can be a data acquisition device such as an electric energy meter, a sensor, a programmable logic controller (PLC) or a remote terminal unit (RTU). The embodiment of the present application does not impose any restrictions on the specific type of electronic device. The sending end and the authentication end are in the same secure network, so that the sending end can safely send the first plaintext data to the authentication end. In one implementation. The sending end and the authentication end can be connected to each other through a communication cable.

[0037] After collecting the data, the sending end will send the collected data to the authentication end, so that the authentication end receives the first plaintext data. The authentication end then processes the first plaintext data through a preset hash function to obtain a first data digest. In the embodiment of the present application, the preset hash function is taken as Message-Digest Algorithm 5 (MD5) as an example.

[0038] It can be understood that the authentication end can obtain a 128-bit first data summary after processing the first plaintext data based on the MD5 algorithm. When the authentication end processes the first plaintext data based on the MD5 algorithm, if the first plaintext data does not meet the processing conditions, the authentication end will perform a padding operation on the first plaintext data so that the first plaintext data after padding meets the processing conditions, and the processing conditions include that the total data length of the first plaintext data is an integer multiple of 1024 bits; the specific padding operation can be to first add a 1 to the end of the first plaintext data. If the first plaintext data still does not meet the processing conditions after the addition, then add at least one 0 after 1 until the first plaintext data meets the processing conditions.

[0039] The authentication end will divide the first plaintext data into multiple data blocks based on 512 bits and determine 4 initial values ​​of 32 bits. The initial value is used to instruct the authentication end to determine the hash value corresponding to the first data block. The hash value includes 4 sub-hash values, and the data bit number of each sub-hash value is 32 bits; the multiple data blocks include the i-th data block, i>1 and i is an integer, the authentication end will use the hash value corresponding to the i-1th data block as the initial value, perform a hash operation on the i-th data block, and obtain the hash value corresponding to the i-th data block; the authentication end will combine the hash values ​​corresponding to the last numerical control block as the first data summary.

[0040] The hash operation is performed on the i-th data block, including: performing four rounds of iterative operations on the i-th data block based on a nonlinear function, and using the operation result as the hash value corresponding to the i-th data block; different rounds of iterative operations correspond to different nonlinear functions, and the result of each round of iterative operations is used as the initial value of the next round until the last round is reached. In each round of iterative operations, the authentication end will divide the i-th data block into 16 sub-data blocks based on 32 bits, and process each sub-data block to obtain the operation result of the round.

[0041] It can be understood that, for the i-th data block, the initial value of the first round of iterative calculation is the hash value corresponding to the i-1-th data block.

[0042] Step S102: determining a preset amount of data from the first data summary as a target key.

[0043] The preset number is much smaller than the total amount of data in the first data summary. In the embodiment of the present application, the preset number of 4 bits is taken as an example. The authentication end can use the preset number of data at the end of the first data summary as the target key, or the preset number at the beginning of the first data summary as the target key. It can also use the data combination on at least one data bit in the first data summary as the target key based on preset rules. The preset rules can divide the first data summary into groups of preset data amounts and select one data from each group, or select an array of specific data bits in the first data summary, and the total amount of specific data bits is the preset number. In the embodiment of the present application, the 4 bits of data at the end of the first data summary are taken as the target key as an example.

[0044] Step S103: encrypt the first data summary and the first plaintext data based on the target key to obtain ciphertext data.

[0045] The authentication end may combine the first data summary with the first plaintext data, and encrypt the combined data with the target key to obtain ciphertext data. In one example, the authentication end may add the first data summary to the end of the first plaintext data to increase the difficulty for an attacker to attack the data. It is understandable that the authentication end may also use the target key to encrypt the first data summary and the first plaintext data respectively, and combine the encryption results of the two to obtain ciphertext data.

[0046] In one implementation, encrypting the first data digest and the first plaintext data based on the target key to obtain ciphertext data includes: Based on a preset data length, dividing the first data summary and the first plaintext data into at least one data block; Based on the preset encryption algorithm and the target key, each data block is encrypted to obtain the sub-encryption result corresponding to each data block; Combine each sub-encryption result to get the ciphertext data.

[0047] The preset data length is less than the total amount of data of the first data summary, and 62 bits is taken as an example in the embodiment of the present application. The preset encryption algorithm can be an improved symmetric encryption algorithm, which mainly uses the target key determined by the authentication end to encrypt the data in blocks. The improved symmetric encryption algorithm does not need to involve complex mathematical operations such as large integer decomposition or discrete logarithm problems like the asymmetric encryption algorithm, which can ensure the efficiency of data encryption.

[0048] After combining the first data summary with the first plaintext data, the authentication end divides the combined data into at least one data block based on the preset data length. For each data block, the authentication end performs multiple rounds of encryption processing on the data block based on the preset encryption algorithm and the target key, and finally combines the sub-encryption results corresponding to each data block to obtain the ciphertext data.

[0049] In one implementation, in the first round of encryption processing, for each data block, the authentication end can encrypt the data block through a series of permutation and replacement operations (the specific operations can be determined based on a preset encryption algorithm), for example, certain data bits in the data block are exchanged according to a fixed pattern, and then some data bits are replaced based on the target key (for example, certain data bits in the data block are XORed with corresponding bits in the target key, etc.). The encryption result of this round is used as the input data of the next round. In this way, the operation on the data block in each round of encryption processing may be different according to the change of the number of rounds. As a result, in each round of encryption processing, the state of the data block is constantly changing, and it becomes more and more difficult to crack.

[0050] It can be understood that the target key can also be processed in each round of encryption processing, for example, certain data bits in the target key are exchanged according to a fixed pattern, or the target key is rotated.

[0051] In one example, if Figure 3 As shown, the electric energy meter in the substation (an example of the sending end) collects multiple voltages of the transformer, and summarizes the collected multiple voltages into a data string (an example of the multiple voltages being the first plaintext data) and sends it to the gateway (an example of the authentication end). After the server determines the 128-bit MD5 value of the data string (an example of the first data summary), it uses the following 4 bits of data as the key (an example of the target key) and adds the MD5 value to the end of the data string to obtain 216 bits of data.

[0052] The gateway groups 216 bits of data into three data blocks based on 62 bits, and performs three rounds of encryption on each data block. In the first round of encryption, the gateway fills the key with 62 bits, and XORs each bit of each data block with the corresponding bit of the key after filling, to obtain the first round of encryption results for each data block; in the second round of encryption, the gateway replaces several bits of the 62-bit key with other data based on the lookup table to update the key, and exchanges the first two bits with the last two bits in the first round of encryption results of each data block, and XORs each first round encryption result after each exchange with the corresponding bit of the updated key to obtain the second round of encryption results for each data block; in the third round of encryption, the gateway performs a shift operation on each second round of encryption results, and XORs each second round encryption result after the shift with the corresponding bit of the key before the update, to obtain the sub-encryption results corresponding to the three data blocks. Each sub-encryption result is combined in sequence to obtain the ciphertext data. Then the digital signature and ciphertext data are sent to the dispatch center (an example of the receiving end) for subsequent processing by the dispatch center.

[0053] In the above technical solution, the first data summary and the first plaintext data are encrypted in blocks based on the target key, and the sub-encryption results corresponding to each data block are combined to obtain the ciphertext data. There is no need to encrypt the entire plaintext data and the data summary as a whole at one time. The encryption speed is fast, and large files can be encrypted, thereby improving the efficiency of secure data transmission when the amount of data is large.

[0054] Step S104: encrypt the target key based on the target key to obtain a digital signature corresponding to the first plaintext data.

[0055] The authenticator can encrypt the target key itself based on the target key through a preset encryption algorithm to obtain a digital signature.

[0056] Step S105, sending the ciphertext data and the digital signature to the receiving end.

[0057] In this embodiment, the receiving end obtains the target key when receiving the ciphertext data and the digital signature, verifies the data signature based on the target key, and if the digital signature verification passes, decrypts the ciphertext data based on the target key to obtain the first data summary, and obtains the first plaintext data based on the decryption result of the ciphertext data and the first data summary.

[0058] In the embodiment of the present application, the plaintext data sent by the sender is encrypted and forwarded to the receiving end by the authentication end, and the authentication end also generates a digital signature corresponding to the plaintext data, and sends the digital signature to the receiving end. In this way, the receiving end can double-verify the received data through the digital signature and the ciphertext data, determine the security and reliability of the data, and realize the secure transmission of the data. The key used by the authentication end is part of the data determined from the data summary of the plaintext data. Different keys can be obtained for the plaintext data sent by different senders. There is no need to generate different keys for different communication parties through the key generation algorithm, and there is no need to issue and manage the keys, which greatly reduces the workload on key generation and management. And the authentication end encrypts the data and obtains the digital signature with the same key, and there is no need to encrypt the data and generate the digital signature based on different keys as in the traditional data transmission scheme, thereby speeding up the data transmission efficiency. In addition, the receiving end will obtain the same key to verify the digital signature and decrypt the ciphertext data, and there is no need to encrypt and decrypt the data and digital signature based on different private keys and public keys, thereby reducing the complexity of data processing and algorithms during data transmission, and improving the data transmission efficiency.

[0059] Figure 4 is a flow chart of another data transmission method provided in an embodiment of the present application, such as Figure 4 The method is applied to the authentication end, and the method includes the following steps: Step S201, receiving the first plaintext data sent by the sending end. Figure 2 Step S101 in the illustrated embodiment is not described in detail here.

[0060] Step S202: performing data preprocessing operations on the first plaintext data.

[0061] In this embodiment, the data preprocessing operation includes at least one of cleaning data, converting data format, discretizing continuous variables, classifying data, or integrating data.

[0062] The purpose of cleaning data is to identify and correct errors, outliers, and missing values ​​in the first plaintext data. Cleaning data may include processing missing values ​​and processing outliers. Processing missing values ​​may include filling missing values ​​in the first plaintext data and deleting repeated records of missing values ​​in the first plaintext data. The authentication end may fill missing values ​​in the first plaintext data by means of mean, median, and / or mode statistics, or predict missing values ​​and fill them by using regression methods, or predict missing values ​​and fill them by using K-Nearest Neighbors algorithm (KNN). Processing outliers may include the authentication end using the statistical method 3σ principle to identify outliers, or using box plots to visualize and identify constants, and then decide whether to retain, delete, or correct outliers.

[0063] The purpose of converting the data format is to convert the first plaintext data into a format that is convenient for subsequent receiving end to analyze or model. Converting the data format may include data type conversion, data standardization and normalization processing, and data scaling. For example, the authentication end may convert the character string in the first plaintext data into a numerical type, and convert the numerical type data in the first plaintext data into a categorical type data; then the authentication end performs data standardization and normalization processing on the converted first plaintext data, and then scales the first plaintext data to a range with a mean of 0 and a standard deviation of 1, and at the same time scales the first plaintext data to a range of 0 to 1.

[0064] Discretizing continuous variables is the process of converting continuous variables in the first plaintext data into discrete variables. Categorizing data is to divide the first plaintext data into intervals containing the same number of records, and use the K-means clustering algorithm (K-means Clustering Algorithm, K-means) to divide the data in each interval into different clusters.

[0065] Integrating data means that the authentication end merges the data from multiple data sources in the first plaintext data into a unified data set. The authentication end can use the Structured Query Language (SQL) to query and merge the data from multiple data sources in the first plaintext data, use the open source Pandas tool to merge the data frames, and perform redundancy processing on the merged data, identify and delete duplicate or redundant fields.

[0066] In this way, through careful data preprocessing, the accuracy of plaintext data and the performance of secure data transmission can be significantly improved.

[0067] Step S203: determining a first data summary of the processed first plaintext data based on a preset hash function.

[0068] Step S203 is detailed in Figure 2 In step S101 in the illustrated embodiment, the authentication end merely replaces the first plaintext data with the processed first plaintext data, which will not be described in detail here.

[0069] Through data preprocessing operations, the original data, that is, the first plaintext data, can be cleaned, converted, normalized, classified and / or variable discretized, etc., which can effectively remove errors and redundant parts in the first plaintext data, unify the data format and classify the data, improve data reliability and reduce the total amount of data, and speed up the efficiency of subsequent data encryption.

[0070] Step S204: determine a preset amount of data from the first data summary as a target key.

[0071] Step S205: encrypt the first data summary and the first plaintext data based on the target key to obtain ciphertext data.

[0072] Step S206: encrypt the target key based on the target key to obtain a digital signature corresponding to the first plaintext data.

[0073] Step S206, sending the ciphertext data and the digital signature to the receiving end.

[0074] For details of steps S204 to S206, see Figure 2 Steps S102 to S105 in the illustrated embodiment are not described in detail here.

[0075] Step S208: upon receiving a key acquisition request sent by the receiving end, sending the target key to the receiving end.

[0076] After the ciphertext data and digital signature of the authentication end are sent to the receiving end, the receiving end needs to obtain the target key to verify the digital signature and decrypt the ciphertext data. Therefore, the receiving end will send a key acquisition request to the authentication end after receiving the ciphertext data and digital signature. In response to the request, the authentication end will send the target key to the receiving end for subsequent processing by the receiving end. Sending the target key and ciphertext data separately to the receiving end can reduce the probability of the target key and ciphertext data being intercepted together, thereby improving the security of data transmission.

[0077] In one implementation, before sending the ciphertext data and the digital signature to the receiving end, the process further includes: The target key is sent to the sending end, and the sending end sends the target key to the receiving end when receiving the key acquisition request sent by the receiving end. After sending the target key to the sending end, the receiving end can also request the target key from the sending end, so that the receiving end has multiple key acquisition methods.

[0078] It can be understood that the data transmission method and the data receiving method in the embodiments of the present application can be applied in scenarios such as power plants, substations or power grid dispatching centers to realize the data collection, sending and receiving of equipment such as generator sets, control systems or auxiliary equipment in the scene, or to realize the collection, sending and receiving of major parameters such as voltage or current, so as to facilitate the detection of abnormal situations and improve the safety of equipment or system operation.

[0079] In the embodiment of the present application, before encrypting the plaintext data and generating the digital signature based on the unified key, the authentication end cleans, converts, normalizes, classifies and / or discretizes the plaintext data through data preprocessing operations, which can effectively remove errors and redundant parts in the first plaintext data, unify the data format and classify the data, improve the reliability of the data and reduce the total amount of data, thereby speeding up the efficiency of subsequent data encryption. And through the target key, digital signature and data summary, the encryption, identity authentication and integrity verification of the transmitted plaintext data are unified, which improves the security of data transmission.

[0080] Figure 5 is a flow chart of a data receiving method in an embodiment of the present application, the method is applied to the receiving end, such as Figure 5 The method shown comprises the following steps: Step S301, upon receiving the ciphertext data and the digital signature, obtain the target key.

[0081] In this embodiment, the target key is a preset amount of data determined by the authentication end from the first data summary, and the first data summary is a data summary of the first plaintext data; the first plaintext data is the data sent by the sending end to the authentication end, the ciphertext data is obtained by the authentication end encrypting the first data summary and the first plaintext data based on the target key, and the digital signature is obtained by the authentication end encrypting the target key based on the target key.

[0082] The receiving end can be a terminal device such as a server, a controller, a desktop computer or a laptop computer. The embodiment of the present application does not impose any restrictions on the specific type of the terminal device. When the receiving end receives the ciphertext data and digital signature sent by the authentication end through the communication protocol, it will send a key acquisition request to the authentication end or the sending end, and then receive the target key sent by the authentication end or the sending end.

[0083] In one example, the ciphertext data is associated with the digital signature corresponding to the first plaintext data, and the ciphertext data includes the authentication end address and the sending end address. After receiving the data sent by the authentication end, the receiving end will parse the data. When it is parsed that the data is encrypted data and is also associated with a digital signature, it can be determined based on the authentication end address in the data whether the data is the ciphertext data and digital signature sent by the authentication end, and then a key acquisition request can be sent to the authentication end based on the authentication end address, or a key acquisition request can be sent to the sending end based on the sending end address.

[0084] Step S302: verify the digital signature based on the target key.

[0085] In one implementation, verifying a digital signature based on a target key includes: Decrypt the digital signature based on the target key to obtain a decrypted signature; Compare the decrypted signature with the target key; When the decrypted signature matches the target key, it is determined that the digital signature verification has passed; In the case where the decrypted signature does not match the target key, it is determined that the digital signature verification has failed.

[0086] The receiving end can decrypt the digital signature based on the inverse process of encrypting the target key by the authentication end and the target key, and then compare the decrypted signature with the target key bit by bit. If there is any inconsistency in the data on any data bit, it is determined that the digital signature verification has failed. If the data on each data bit is consistent, it is determined that the digital signature verification has passed.

[0087] In the above technical solution, when the receiving end digitally verifies the signature, it decrypts the digital signature through the target key that is the same as that used when the authenticating end generated the digital signature, and obtains the verification result based on a simple comparison of the target key and the decrypted signature. There is no need to verify the signature based on private keys, public keys and complex data processing processes as in traditional asymmetric encryption transmission. While simplifying the digital signature verification process, it can also speed up the digital verification process, thereby improving the efficiency of secure data transmission.

[0088] Step S303: When the digital signature verification is successful, the ciphertext data is decrypted based on the target key to obtain a first data summary.

[0089] The receiving end can decrypt the ciphertext data based on the inverse process of encrypting the plaintext data and the first data summary by the authenticating end and the target key, and then separate the first data summary from the decryption result obtained by decryption.

[0090] Step S304: Obtain first plaintext data based on the decryption result of the ciphertext data and the first data summary.

[0091] In one implementation, obtaining the first plaintext data based on the decryption result of the ciphertext data and the first data summary includes: Determine a second data digest corresponding to the plaintext data in the decryption result; When the second data digest matches the first data digest, the plaintext data in the decryption result is determined to be the first plaintext data, and the first plaintext data is stored.

[0092] The receiving end separates the plaintext data from the decryption result, and determines the second data summary corresponding to the plaintext data based on the preset hash function. Then the second data summary is compared with the first data summary bit by bit. If there is any inconsistency in the data on any data bit, it is determined that the decrypted plaintext data is tampered data and the plaintext data is discarded. If the data on each data bit is consistent, it is determined that the decrypted plaintext data is the tampered first plaintext data and the plaintext data is stored. The second data summary corresponding to the plaintext data in the decryption result is re-determined, and the second data summary is compared with the first data summary to verify the data integrity.

[0093] In the embodiment of the present application, the ciphertext data received by the receiving end is the data obtained by encrypting the plaintext data and the data summary of the authentication end based on the target key, and the digital signature is the data obtained by the authentication end after encrypting the device itself based on the target key. In this way, after the receiving end decrypts the digital signature and compares the decrypted result, the decrypted result of the digital signature can be compared with the target key to verify the digital signature. There is no need to verify the digital signature through complex exponential, logarithmic and modulus operations like traditional asymmetric encryption, which improves the verification efficiency of the digital signature. And after the signature verification is passed, it is also necessary to obtain the plaintext data based on the decryption result and the data summary of the receiving end to achieve the purpose of double verification of the data, thereby improving the security and reliability of the data. In addition, the keys used by the receiving end and the authentication end are both data of a preset data amount determined from the data summary, realizing symmetric encryption operations based on a unified key, combining double data verification with symmetric encryption, and there is no need to use asymmetric encryption algorithms to improve the efficiency of secure data transmission.

[0094] Figure 6 This is a schematic diagram of the structure of the authentication terminal provided in one embodiment of the present application. Figure 6 As shown, the authentication terminal 6 of this embodiment includes: at least one processor 60 ( Figure 6 Only one is shown in the figure) a processor, a memory 61, and a computer program 62 stored in the memory 61 and executable on the at least one processor 60, and when the processor 60 executes the computer program 62, the steps in the above-mentioned data transmission method embodiments are implemented.

[0095] The authentication terminal 6 can be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The authentication terminal can include, but is not limited to, a processor 60 and a memory 61. Those skilled in the art can understand that Figure 6 It is only an example of the authentication terminal 6 and does not constitute a limitation on the authentication terminal 6. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components, for example, it may also include input and output devices, network access devices, etc.

[0096] The processor 60 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0097] In some embodiments, the memory 61 may be an internal storage unit of the authentication terminal 6, such as a hard disk or memory of the authentication terminal 6. In other embodiments, the memory 61 may also be an external storage device of the authentication terminal 6, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the authentication terminal 6. Further, the memory 61 may also include both an internal storage unit and an external storage device of the authentication terminal 6. The memory 61 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program. The memory 61 may also be used to temporarily store data that has been output or is to be output.

[0098] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the data transmission method or the data receiving method in any of the above embodiments can be implemented.

[0099] An embodiment of the present application provides a computer program product. When the computer program product is executed, the data transmission method or data receiving method in any of the above embodiments can be implemented.

[0100] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0101] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0102] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0103] In the embodiments provided in the present application, it should be understood that the disclosed devices / network equipment and methods can be implemented in other ways. For example, the device / network equipment embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0104] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0105] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A data transmission method, characterized in that: Applied to the authentication end, the method includes: Receiving first plaintext data sent by a sending end, and determining a first data summary of the first plaintext data; Determine a preset amount of data from the first data digest as a target key; Encrypt the first data digest and the first plaintext data based on the target key to obtain ciphertext data; Encrypting the target key based on the target key to obtain a digital signature corresponding to the first plaintext data; The ciphertext data and the digital signature are sent to a receiving end. Upon receiving the ciphertext data and the digital signature, the receiving end obtains the target key, verifies the data signature based on the target key, and, if the digital signature verification passes, decrypts the ciphertext data based on the target key to obtain the first data summary, and obtains the first plaintext data based on the decryption result of the ciphertext data and the first data summary.

2. The method according to claim 1, characterized in that Encrypting the first data digest and the first plaintext data based on the target key to obtain ciphertext data includes: Based on a preset data length, dividing the first data summary and the first plaintext data into at least one data block; Encrypt each of the data blocks based on a preset encryption algorithm and the target key to obtain a sub-encryption result corresponding to each of the data blocks; Each of the sub-encryption results is combined to obtain the ciphertext data.

3. The method according to claim 1 or 2, characterized in that After sending the ciphertext data and the digital signature to the receiving end, the method further includes: When receiving the key acquisition request sent by the receiving end, the target key is sent to the receiving end.

4. The method according to claim 3, characterized in that Before sending the ciphertext data and the digital signature to the receiving end, the method further includes: The target key is sent to the sending end, and when the sending end receives the key acquisition request sent by the receiving end, the sending end sends the target key to the receiving end.

5. The method according to claim 1 or 2, characterized in that: Before determining the first data summary of the first plaintext data, the method further includes: Performing a data preprocessing operation on the first plaintext data; the data preprocessing operation includes at least one of cleaning data, converting data format, discretizing continuous variables, classifying data, or integrating data; The determining a first data summary of the first plaintext data includes: Based on a preset hash function, the first data summary of the processed first plaintext data is determined.

6. A data receiving method, characterized in that: Applied to the receiving end, the method includes: Upon receiving the ciphertext data and the digital signature, a target key is obtained, wherein the target key is data of a preset data amount determined by the authentication end from the first data digest, wherein the first data digest is a data digest of the first plaintext data; the first plaintext data is data sent by the sending end to the authentication end, the ciphertext data is obtained by the authentication end encrypting the first data digest and the first plaintext data based on the target key, and the digital signature is obtained by the authentication end encrypting the target key based on the target key; verifying the digital signature based on the target key; In the case where the digital signature verification passes, decrypting the ciphertext data based on the target key to obtain the first data summary; The first plaintext data is obtained based on the decryption result of the ciphertext data and the first data summary.

7. The method according to claim 6, characterized in that The obtaining the first plaintext data based on the decryption result of the ciphertext data and the first data summary includes: Determine a second data digest corresponding to the plaintext data in the decryption result; When the second data digest matches the first data digest, the plaintext data in the decryption result is determined to be the first plaintext data, and the first plaintext data is stored.

8. The method according to claim 6, characterized in that The verifying the digital signature based on the target key comprises: Decrypting the digital signature based on the target key to obtain a decrypted signature; comparing the decrypted signature with the target key; If the decrypted signature matches the target key, determining that the digital signature verification passes; In the event that the decrypted signature does not match the target key, it is determined that the digital signature verification has failed.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the computer program implements the data transmission method according to any one of claims 1 to 5 or the data receiving method according to any one of claims 6 to 8.

10. A computer program product, characterized in that The invention comprises a computer program, which, when being executed, enables the data transmission method according to any one of claims 1 to 5 or the data receiving method according to any one of claims 6 to 8 to be executed.

Images