Network data processing method and storage medium

Abstract

The application discloses a network data processing method and a storage medium, and the method comprises the following steps: a data sending end acquires network operation data, divides the network operation data, and determines a plurality of target data blocks with a first length corresponding to the network operation data according to a division result; the data sending end respectively encrypts each target data block through an initialization vector to obtain a ciphertext data block corresponding to the target data block, and generates a data authentication tag corresponding to the ciphertext data block; and the data sending end sends the ciphertext data block and the data authentication tag to a data receiving end, so that the data receiving end performs security verification on the ciphertext data block through the data authentication tag and decrypts the network operation data through the initialization vector and the ciphertext data block, the confidentiality and integrity protection of data in the transmission process can be realized, and the safe transmission and verification of the network operation data are ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network data application, and particularly relates to a network data processing method and a storage medium. BACKGROUND

[0002] In modern network communication, secure transmission of data is a key issue. Traditional data transmission methods often face the risk of data eavesdropping, tampering and forgery, especially in scenarios involving sensitive information such as financial transactions, medical data transmission, etc. In order to ensure the integrity and authenticity of data, an efficient and secure encryption and verification mechanism is needed.

[0003] In related technologies, although the encryption method can protect data to some extent, it still has certain security risks when facing complex network environments and advanced attack means. In addition, the division and encryption process of data is not standardized, which makes it difficult to ensure the reliability and consistency of data in the transmission process. SUMMARY

[0004] The present application provides a network data processing method and a storage medium to solve the problem of data eavesdropping, tampering and forgery in data transmission in related technologies, and the problem of lack of standardization in data division and encryption process.

[0005] According to an aspect of the present application, a network data processing method is provided, applied to a data sending end, the method comprising:

[0006] Obtaining network operation data, dividing the network operation data, and determining a plurality of target data blocks of a first length corresponding to the network operation data according to the division result;

[0007] Encrypting each target data block by an initialization vector to obtain a ciphertext data block corresponding to the target data block, and generating a data authentication tag corresponding to the ciphertext data block;

[0008] Sending the ciphertext data block and the data authentication tag to a data receiving end, so that the data receiving end performs security verification on the ciphertext data block through the data authentication tag and decrypts the network operation data through the initialization vector and the ciphertext data block.

[0009] According to another aspect of the present application, a network data processing method is provided, applied to a data receiving end, the method comprising:

[0010] Receiving a ciphertext data block, an initialization vector and a data authentication tag corresponding to network operation data sent by a data sending end, and generating a data authentication tag corresponding to the ciphertext data block;

[0011] In a case where the generated data authentication tag is identical to the data authentication tag sent by the data sending end, the ciphertext data block is decrypted according to the initialization vector to obtain network operation data corresponding to the ciphertext data block.

[0012] According to another aspect of the present application, a network data processing device is provided, which is applied to a data sending end, and comprises:

[0013] A first target data block determination module is configured to obtain network operation data, divide the network operation data, and determine a plurality of target data blocks of a first length corresponding to the network operation data according to a division result.

[0014] A first data authentication tag generation module is configured to encrypt each target data block by an initialization vector to obtain a ciphertext data block corresponding to the target data block, and generate a data authentication tag corresponding to the ciphertext data block.

[0015] A first network operation data decryption module is configured to send the ciphertext data block and the data authentication tag to a data receiving end, so that the data receiving end performs security verification on the ciphertext data block by the data authentication tag and decrypts the network operation data by the initialization vector and the ciphertext data block.

[0016] According to another aspect of the present application, a network data processing device is provided, which is configured to a data receiving end, and comprises:

[0017] A second data authentication tag generation module is configured to receive a ciphertext data block, an initialization vector and a data authentication tag corresponding to network operation data sent by a data sending end, and generate a data authentication tag corresponding to the ciphertext data block.

[0018] A second network operation data decryption module is configured to decrypt the ciphertext data block according to the initialization vector in a case where the generated data authentication tag is identical to the data authentication tag sent by the data sending end, to obtain network operation data corresponding to the ciphertext data block.

[0019] According to another aspect of the present application, an electronic device is provided, which comprises:

[0020] at least one processor; and

[0021] a memory connected to the at least one processor in communication; wherein

[0022] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the network data processing method according to any one of the embodiments of the application.

[0023] According to another aspect of the application, a computer readable storage medium is provided, which stores computer instructions for enabling a processor to implement the network data processing method according to any one of the embodiments of the application when executed by the processor.

[0024] The technical scheme of the embodiment of the application first divides network operation data, determines a plurality of target data blocks of a first length corresponding to the network operation data according to the division result, and performs data division and standardization processing, thereby ensuring the efficiency and consistency of data transmission. Then, each target data block is encrypted by an initialization vector to obtain a ciphertext data block corresponding to the target data block, and a data authentication tag corresponding to the ciphertext data block is generated, thereby ensuring the confidentiality and integrity of the data and effectively preventing the data from being tampered with and forged. Finally, the ciphertext data block and the data authentication tag are sent to a data receiving end, so that the data receiving end performs security verification on the ciphertext data block through the data authentication tag and decrypts the network operation data through the initialization vector and the ciphertext data block. The data transmission integrity and authenticity can be ensured through data authentication tag verification and initialization vector decryption, the risk of data eavesdropping, tampering and forgery in data transmission in the related art is solved, and the problem of lack of standardization in data division and encryption process is solved. The confidentiality and integrity of the data in the transmission process can be protected, and the safe transmission and verification of the network operation data can be ensured.

[0025] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the application, nor is it used to limit the scope of the application. Other features of the application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0027] Figure 1 is a flowchart of a network data processing method provided by the first embodiment of the application;

[0028] Figure 2 is a flow chart of a network data processing method according to the second embodiment of the present application;

[0029] Figure 3 is a flow chart of a network data processing method according to the third embodiment of the present application;

[0030] Figure 4 is a structural schematic diagram of a network data processing device according to the fourth embodiment of the present application;

[0031] Figure 5 is a structural schematic diagram of a network data processing device according to the fifth embodiment of the present application;

[0032] Figure 6 is a structural schematic diagram of an electronic device implementing the network data processing method according to the sixth embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to make the personnel in the technical field better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the present application.

[0034] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0035] It should be noted that the modification of "one" or "multiple" mentioned in the present disclosure is illustrative but not restrictive, and those skilled in the art should understand that unless otherwise explicitly indicated in the context, it should be understood as "one or more".

[0036] The names of the messages or information exchanged between the multiple devices in the embodiments of the present disclosure are only for illustrative purposes, and are not intended to limit the scope of the messages or information.

[0037] It can be understood that, before using the technical solutions disclosed in the embodiments of the present disclosure, the type, use range, use scenario, etc. of the personal information involved in the present disclosure should be informed to the user and the authorization of the user should be obtained through appropriate means according to relevant laws and regulations.

[0038] For example, in response to receiving the active request of the user, prompt information is sent to the user to explicitly prompt the user that the operation requested to be performed will require obtaining and using the personal information of the user. Thus, the user can voluntarily choose whether to provide the personal information to the software or hardware such as electronic device, application program, server or storage medium, etc. that performs the operation of the technical solutions of the present disclosure according to the prompt information.

[0039] As an optional but non-limiting implementation manner, in response to receiving the active request of the user, the manner of sending the prompt information to the user may, for example, be the manner of pop-up window, and the prompt information may be presented in the form of text in the pop-up window. In addition, the pop-up window may also carry selection controls for the user to select "agree" or "disagree" to provide the personal information to the electronic device.

[0040] It can be understood that the above notification and obtaining of user authorization process is only illustrative, and does not limit the implementation manner of the present disclosure, and other manners meeting the relevant laws and regulations can also be applied to the implementation manner of the present disclosure.

[0041] It can be understood that the data involved in the present technical solution (including but not limited to the data itself, the acquisition or use of the data) should comply with the requirements of the relevant laws and regulations and the relevant provisions.

[0042] Embodiment one

[0043] Figure 1 A flowchart of a network data processing method is provided for the first embodiment of the present application. The present embodiment can be applied to data transmission with high security and data integrity, and is applied to a data sending end. The method can be executed by a network data processing device, which can be realized in the form of hardware and / or software. Optionally, the network data processing device is realized by an electronic device, which can be a mobile terminal, a PC terminal or a server, etc.

[0044] As shown in FIG. 1, the method can specifically include: Figure 1

[0045] S110, obtaining network running data, dividing the network running data, and determining a plurality of target data blocks of a first length corresponding to the network running data according to the division result.

[0046] ​The data sending end can be understood as a party responsible for generating and sending data in network communication, and is used for preparing, encrypting and sending data. The data sending end can be any type of device or system, including but not limited to servers, computers and mobile devices, etc. The network running data can be understood as various types of data transmitted in the communication network. The network running data can include but is not limited to information sent by users (such as text messages, pictures, videos, etc.), network status information (such as bandwidth usage, delay, packet loss rate, etc.), and system operation logs, etc. The network running data can be used to detect network performance, troubleshoot and optimize network services, etc. The division result can be understood as the result of dividing larger network running data into several smaller network running data, which can improve the efficiency and reliability of network running data in the transmission process. The first length can be understood as a standard for quantifying the uniform length of all target data blocks, which can ensure the standardization of target data blocks and facilitate processing and transmission. The target data block can be understood as each small data unit after division, and the target data block is a data unit of the first length, which is convenient for subsequent encryption and transmission.

[0047] On the basis of the above scheme, optionally, the network running data is divided, and a plurality of target data blocks of the first length corresponding to the network running data are determined according to the division result, including: dividing the network running data according to the first length to obtain at least one initial data block, in the case that the length of the initial data block reaches the first length, the initial data block is taken as a target data block; in the case that the length of the initial data block does not reach the first length, the initial data block is padded to the first length according to a preset padding algorithm, and the padded initial data block is taken as a target data block.

[0048] The initial data block can be understood as a preliminary data block obtained by dividing the network running data, and the length of the initial data block can not be completely consistent. The preset padding algorithm can be understood as an algorithm for padding the initial data block to the first length, which is used to pad the initial data block using the preset padding algorithm in the case that the length of the initial data block does not reach the first length, so as to ensure that the length of the initial data block reaches the first length. The preset padding algorithm can be zero padding, random padding or other specific padding methods.

[0049] An optional embodiment assumes that the first length is 1024 bytes, the network running data is 3200 bytes, after division, the first initial data block is 1024 bytes, the second initial data block is 1024 bytes, and the third initial data block is 1152 bytes. The first initial data block and the second initial data block have a length of 1024 bytes, which is the same as the first length, and can be directly used as target data blocks; for the third initial data block, which exceeds the first length, it can be further divided; the first 1024 bytes of the third initial data block are used as a target data block, and the remaining 128 bytes are padded to 1024 bytes using a preset padding algorithm, which is used as a target data block; finally, the generated target data blocks all have a length of 1024 bytes.

[0050] The above scheme divides the network running data into target data blocks of a fixed length (the first length), and pads the initial data block that is less than the fixed length using a preset padding algorithm, thereby ensuring the standardization of all data blocks, improving the efficiency of data processing and transmission, and enhancing the security and integrity of the data.

[0051] S120, each of the target data blocks is encrypted by an initialization vector to obtain a ciphertext data block corresponding to the target data block, and a data authentication tag corresponding to the ciphertext data block is generated.

[0052] The initialization vector can be understood as a random or pseudo-random value used in the encryption algorithm to increase the security of encryption and prevent the same target data block from producing the same ciphertext after encryption at different times, thereby improving security. The encryption can be understood as a process of converting the target data block into a ciphertext data block to protect the confidentiality and integrity of the data to be transmitted. The ciphertext data block can be understood as a target data block that has been encrypted. The ciphertext data block cannot be directly read, and can only be restored to the target data block by using the correct key and decryption algorithm. The data authentication tag can be understood as an additional information tag for verifying the integrity and authenticity of the data, which is used to ensure that the data in the received ciphertext data block has not been tampered with, and the receiver can verify the source and integrity of the data by verifying the data authentication tag.

[0053] On the basis of the above scheme, the generation of the data authentication tag corresponding to the ciphertext data block can include: obtaining a preset authentication value, performing Galois field multiplication operation on each of the ciphertext data blocks, performing XOR operation on the operation result of the ciphertext data block and the preset authentication value, and obtaining the data authentication tag corresponding to the ciphertext data block.

[0054] The preset authentication value can be understood as a fixed value preset for generating the data authentication tag. The Galois field is a kind of finite field with a limited number of elements. The Galois field multiplication operation can be understood as a special mathematical operation, which is often used in cryptography and can provide good diffusion and confusion to enhance the security of data. For example, in the Galois field, the multiplication operation result of two bytes is still one byte.

[0055] In an optional embodiment, the data sending end generates a preset authentication value of 128 bits, which remains unchanged during the entire data transmission process, such as 0x1A2B3C4D5E6F78901234567890ABCDEF; each ciphertext data block is processed using the Galois field multiplication operation, and the ciphertext data block C is a 128-bit value of 0x1234567890ABCDEF1234567890ABCDEF. In the GF(2^128) field, a fixed multiplication factor K (0x02) is selected, and the result m of c*k is calculated as 0x2468ACCE13579BDF2468ACCE13579BDF; the result m of the Galois field multiplication operation is XORed with the preset authentication value, and the result is 0x3E4390836D36E34F365CAAC6A73B6C62; the result obtained by the above XOR operation is confirmed as the data authentication tag corresponding to the ciphertext data block.

[0056] The above scheme generates a data authentication tag with high security and uniqueness, which can effectively verify the integrity and authenticity of the data. The combination of the Galois field multiplication operation and the XOR operation not only enhances the security of the data, but also improves the reliability and efficiency of the data authentication, making the data more secure during transmission and preventing the risk of data tampering or forgery.

[0057] S130, the ciphertext data block and the data authentication tag are sent to the data receiving end, so that the data receiving end performs security verification on the ciphertext data block through the data authentication tag and decrypts the network running data from the ciphertext data block through the initialization vector and the ciphertext data block.

[0058] The data receiving end can be understood as a party responsible for receiving data in network communication, which is used to receive, verify and decrypt data. The security verification can be understood as a process of checking whether the received ciphertext data block is complete and has not been tampered with through the data authentication tag. The decryption can be understood as a process of converting the ciphertext data block into a target data block. The decryption needs to use the same key and decryption algorithm as the encryption.

[0059] The technical solution of this invention firstly acquires network operation data, divides the network operation data, and determines multiple target data blocks of a first length corresponding to the network operation data based on the division results. Through data division and standardization, the efficiency and consistency of data transmission can be ensured. Next, each target data block is encrypted using an initialization vector to obtain a ciphertext data block corresponding to the target data block, and a data authentication tag corresponding to the ciphertext data block is generated. This ensures the confidentiality and integrity of the data and effectively prevents data tampering and forgery. Finally, by sending the ciphertext data block and the data authentication tag to the data receiving end, the data receiving end performs security verification of the ciphertext data block using the data authentication tag and decrypts the network operation data using the initialization vector and the ciphertext data block. Verification using the data authentication tag and decryption using the initialization vector ensure the integrity and authenticity of data transmission. This solves the risks of data eavesdropping, tampering, and forgery during data transmission in related technologies, as well as the problem of lack of standardization in the data division and encryption process. It can achieve confidentiality and integrity protection of data during transmission, ensuring the secure transmission and verification of network operation data.

[0060] Example 2

[0061] Figure 2 This is a flowchart of a network data processing method provided in Embodiment 2 of the present invention. This embodiment further refines how the data sending end encrypts each target data block using an initialization vector to obtain a ciphertext data block corresponding to the target data block, based on the above embodiments. Optionally, the data sending end encrypts each target data block using an initialization vector to obtain a ciphertext data block corresponding to the target data block, including: the data sending end obtaining a randomly generated initialization vector of a second length, generating a target count value of a third length using a preset counting method, constructing an initial counter block based on the initialization vector and the target count value, wherein the sum of the lengths of the second and third lengths is equal to the first length; the data sending end encrypting the initial counter block using the AES-256 encryption algorithm and a quantum key distribution to obtain a key stream corresponding to the target data block, and performing an XOR operation between the key stream and the target data block to obtain the ciphertext data block corresponding to the target data block. For detailed implementation, please refer to the description of this embodiment. Technical features that are the same as or similar to those in the foregoing embodiments will not be repeated here.

[0062] like Figure 2 As shown, the method may specifically include:

[0063] S210, acquire network operation data, divide the network operation data, and determine a plurality of first length target data blocks corresponding to the network operation data according to the division result.

[0064] S220, acquire a randomly generated second length initialization vector, generate a third length target counter value through a pre-designed counter method, and construct an initial counter block according to the initialization vector and the target counter value, wherein the second length and the third length are equal in length to the first length.

[0065] The pre-designed counter method can be understood as a pre-designed technical method for generating a value of a specific length, which is used to ensure that the generated value meets specific requirements. The initial counter block can be understood as a data block constructed by an initialization vector and a target counter value, which is used in the counter mode of the encryption and decryption process to ensure that the encryption result of each data block is unique and can be spliced from the initialization vector and the target counter value. The total length is equal to the first length.

[0066] S230, using the AES-256 encryption algorithm and the quantum key to encrypt the initial counter block, obtaining the key stream corresponding to the target data block, and performing XOR operation between the key stream and the target data block to obtain the ciphertext data block corresponding to the target data block, and generating the data authentication tag corresponding to the ciphertext data block.

[0067] The AES-256 encryption algorithm can be understood as an implementation of the Advanced Encryption Standard, which usually uses a 256-bit key for encryption to provide high security data encryption. The quantum key can be understood as a key generated by quantum mechanics, which has extremely high security and unpredictability, and can be used in encryption and decryption processes to ensure the high confidentiality of the initial counter block data. The key stream can be understood as a series of key values generated by the encryption algorithm, which is used for XOR operation with the target data block.

[0068] On the basis of the above scheme, before the data sending end uses the AES-256 encryption algorithm and the quantum key to encrypt the initial counter block, it further includes: receiving the quantum state sent by the data sending end based on the pre-designed quantum distribution protocol, determining the target measurement basis corresponding to the quantum state, and determining the target measurement result corresponding to the target measurement basis; feeding back the target measurement basis and the target measurement result corresponding to the target measurement basis to the data sending end, so that the data sending end determines the quantum key according to the received measurement result corresponding to the quantum state and the target measurement basis, and sends the quantum key to the data receiving end.

[0069] The quantum distribution protocol can be understood as a protocol for securely distributing a key between two communication parties by using quantum mechanics principles, and is used to ensure the security of the generation and distribution process of the key. The quantum state can be understood as a physical quantity used to encode information in the quantum key distribution process. The target measurement basis can be understood as a basis selected by the receiver for measuring the quantum state in the quantum key distribution process. The target measurement result can be understood as a result obtained by the receiver after measuring the quantum state using the target measurement basis in the quantum key distribution process, and is used to generate a quantum key.

[0070] The above scheme generates a highly secure quantum key through a quantum key distribution protocol, and encrypts the initial counter block using an AES-256 encryption algorithm before data transmission, ensuring that the generation and distribution of the key are highly secure, effectively preventing man-in-the-middle attacks and eavesdropping. The unpredictability and high security of the quantum key, combined with the strong encryption capabilities of AES-256, greatly improve the overall security and reliability of data transmission, ensuring that data cannot be tampered with or forged during transmission, thereby protecting the security of sensitive information.

[0071] S240, the ciphertext data block, the initialization vector and the data authentication tag are sent to the data receiving end, so that the data receiving end securely verifies the ciphertext data block through the data authentication tag and decrypts the network operation data through the initialization vector and the ciphertext data block.

[0072] The technical scheme of the embodiment of the application acquires a randomly generated initialization vector and a target counter value through a data sending end, constructs an initial counter block, and encrypts it using an AES-256 encryption algorithm and a quantum key to generate a key stream. The key stream is XORed with the target data block to generate a ciphertext data block. Before encryption, the data sending end and the receiving end generate and share a quantum key through a quantum distribution protocol, ensuring the security and unpredictability of the key. This not only improves the confidentiality and integrity of data transmission, preventing data from being tampered with and forged, but also ensures the efficiency and consistency of data transmission through standardized data division and encryption processes, improving overall security and reliability.

[0073] Embodiment three

[0074] Figure 3 A flowchart of a network data processing method is provided for the third embodiment of the application. This embodiment can be applied to data transmission scenarios with high security and data integrity. The method can be executed by a network data processing device, which can be implemented in hardware and / or software. Optionally, the device can be implemented by an electronic device, such as a mobile terminal, a PC, or a server.

[0075] As Figure 3 shown, the method, specifically can include:

[0076] S310, receiving the ciphertext data block, the initialization vector and the data authentication tag corresponding to the network running data sent by the data sending end, and generating the data authentication tag corresponding to the ciphertext data block.

[0077] S320, in the case that the generated data authentication tag is same as the data authentication tag sent by the data sending end, decrypting the ciphertext data block according to the initialization vector to obtain the network running data corresponding to the ciphertext data block.

[0078] On the basis of the above scheme, optionally, the decryption of the ciphertext data block according to the initialization vector comprises: generating a target counter value of a third length by a pre-designed counter mode, constructing an initial counter block according to the initialization vector and the target counter value, wherein the second length of the initialization vector and the third length are equal to the first length of the ciphertext data block; using the AES-256 encryption algorithm and the quantum key to encrypt the initial counter block to obtain the key stream corresponding to the initial counter block, and performing XOR operation between the key stream and the ciphertext data block to obtain the target data block corresponding to the ciphertext data block.

[0079] An optional embodiment, a target counter value of a third length 0x0000000000000001 is generated by a pre-designed counter mode; the 64-bit initialization vector 0x1A2B3C4D5E6F7890 and the 64-bit target counter value 0x0000000000000001 are spliced together to form a 128-bit initial counter block 0x1A2B3C4D5E6F78900000000000000001; the initial counter block 0x1A2B3C4D5E6F78900000000000000001 is encrypted using the AES-256 encryption algorithm and the quantum key to generate a 128-bit key stream 0x2468ACCE13579BDF2468ACCE13579BDF; the 128-bit key stream 0x2468ACCE13579BDF2468ACCE13579BDF is XOR operated with the 128-bit ciphertext data block 0x365CB2B68DFF466E365CB2B68DFF466E to recover the target data block 0x1234567890ABCDEF1234567890ABCDEF.

[0080] The scheme ensures that the decryption process of the ciphertext data block is highly secure and reliable by generating an initial counter block and generating a key stream using an AES-256 encryption algorithm and a quantum key, restores the target data block through an XOR operation, guarantees the integrity and authenticity of the data, enhances the security of data transmission, prevents the risk of data tampering or forgery, improves the efficiency and accuracy of data decryption, and ensures the efficiency and confidentiality of data transmission.

[0081] On the basis of the above scheme, the network data processing method further comprises: receiving a quantum state sent by a data sending end based on a preset quantum distribution protocol, determining a target measurement basis corresponding to the quantum state, and determining a target measurement result corresponding to the target measurement basis; feeding back the target measurement basis and the target measurement result corresponding to the target measurement basis to the data sending end, so that the data sending end determines a quantum key according to the received measurement result corresponding to the quantum state and the target measurement basis; receiving the quantum key sent by the data sending end, and saving the quantum key.

[0082] The above scheme ensures that the generation and distribution of the key are highly secure, effectively prevents man-in-the-middle attacks and eavesdropping, and improves the overall security and reliability of data transmission, ensuring the integrity and confidentiality of data during transmission and preventing the risk of data tampering or forgery.

[0083] On the basis of the above scheme, after obtaining the network running data corresponding to the ciphertext data block, the network security detection module analyzes the network running data to obtain the network security state corresponding to the data sending end; in the case that the network security state corresponding to the data sending end is the risk running state, the target risk type corresponding to the data sending end is determined according to the network running data, and the risk isolation response is determined according to the target risk type.

[0084] The network security detection module can be understood as a software or hardware component that detects potential security threats in network operation data. It can be used to analyze network operation data and identify abnormal behavior and potential security threats. The network security detection module can be trained by a pre-established deep learning model using sample network data. The sample network data can be understood as network data samples used to train the deep learning model, including normal and abnormal network traffic and system logs, etc. For example, a deep learning model can be trained using historical network traffic records and traffic data of known attack patterns. The network security state can be understood as a state that describes the current security status of the network. For example, the network security state can include a safe running state and a risk running state. The safe running state can be understood as a running state in which the network is running normally and no obvious security threats are detected. For example, in the safe running state, the network traffic is normal, there is no abnormal activity, and there is no alarm information in the system log. The risk running state can be understood as a running state in which the network has potential security threats or abnormal behavior. For example, in the risk running state, the network traffic is abnormal, there is alarm information in the system log, and there may be malicious software, unauthorized access, etc. The target risk type can be understood as a specific security threat type determined according to the network operation data in the risk running state. For example, the target risk type can include but is not limited to unauthorized access or data leakage, etc. The risk isolation response can be understood as an isolation and response measure taken for the security threat type. The risk isolation response can include limiting communication with the data sending end and / or starting a pre-set emergency response program, etc. The limitation of communication with the data sending end can be temporary or permanent limitation of network communication with the data sending end to prevent the spread of threats. The starting of the pre-set emergency response program can be understood as the execution of a pre-defined emergency response plan, specifically, isolating infected devices, notifying administrators or starting backup systems, etc.

[0085] The above scheme uses the network security detection module at the data receiving end to analyze network operation data in real time, accurately identifies the network security state of the data sending end, and in the case of detecting a risk running state, can quickly determine the specific target risk type and take appropriate risk isolation response measures, such as limiting communication or starting a pre-set emergency response program. Not only does it improve the security and reliability of the network, effectively preventing the spread of potential security threats, but it also reduces business interruptions and data loss caused by security incidents, ensuring the stable operation of the network and the integrity of the data.

[0086] The technical scheme of the embodiment of the present application receives the ciphertext data block, the initialization vector and the data authentication tag corresponding to the network operation data sent by the data sending end, generates the data authentication tag corresponding to the ciphertext data block, ensures the integrity and authenticity of the data, and in the case that the generated data authentication tag is the same as the data authentication tag sent by the data sending end, decrypts the ciphertext data block according to the initialization vector to obtain the network operation data corresponding to the ciphertext data block, thereby effectively preventing the data from being tampered with and forged, improving the security and reliability of data transmission, ensuring the efficiency and consistency of data transmission through the standardized encryption and verification process, and improving the overall security and credibility.

[0087] Embodiment four

[0088] Figure 4 The structural schematic diagram of a network data processing device provided by the embodiment three of the present application is configured in a data sending end. Figure 4 As shown in the figure, the device comprises a first target data block determination module 410, a first data authentication tag generation module 420 and a first network operation data decryption module 430.

[0089] The first target data block determination module 410 is used for obtaining network operation data, dividing the network operation data, and determining a plurality of target data blocks of a first length corresponding to the network operation data according to the division result; the first data authentication tag generation module 420 is used for respectively encrypting each target data block through an initialization vector to obtain a ciphertext data block corresponding to the target data block, and generating a data authentication tag corresponding to the ciphertext data block; and the first network operation data decryption module 330 is used for sending the ciphertext data block and the data authentication tag to a data receiving end, so that the data receiving end performs security verification on the ciphertext data block through the data authentication tag and decrypts the network operation data through the initialization vector and the ciphertext data block.

[0090] The technical scheme of the embodiment of the application first acquires network operation data through the first target data block determination module 410, divides the network operation data, determines a plurality of first length target data blocks corresponding to the network operation data according to the division result, and through data division and standardization processing, the efficiency and consistency of data transmission can be ensured; then, the first data authentication tag generation module 420 respectively encrypts each target data block through an initialization vector to obtain a ciphertext data block corresponding to the target data block, and generates a data authentication tag corresponding to the ciphertext data block, which can ensure the confidentiality and integrity of the data and effectively prevent the data from being tampered with and forged; finally, the first network operation data decryption module 430 sends the ciphertext data block and the data authentication tag to a data receiving end, so that the data receiving end performs security verification on the ciphertext data block through the data authentication tag and decrypts the network operation data through the initialization vector and the ciphertext data block, which can ensure the integrity and authenticity of data transmission through data authentication tag verification and initialization vector decryption, solve the risk of data eavesdropping, tampering and forgery in data transmission in the related art, and the problem of lack of standardization in data division and encryption process, and can realize confidentiality and integrity protection of data in the transmission process, and ensure the secure transmission and verification of network operation data.

[0091] On the basis of the above scheme, optionally, the first data authentication tag generation module comprises a first initial counter block construction submodule and a ciphertext data block obtaining submodule. The first initial counter block construction submodule is configured to obtain a randomly generated initialization vector of a second length, generate a target counter value of a third length through a pre-designed number mode, and construct an initial counter block according to the initialization vector and the target counter value, wherein the lengths of the second length and the third length are equal to the first length. The ciphertext data block obtaining submodule is configured to encrypt the initial counter block by using an AES-256 encryption algorithm and a quantum key to obtain a key stream corresponding to the target data block, and perform an exclusive or operation on the key stream and the target data block to obtain a ciphertext data block corresponding to the target data block.

[0092] On the basis of the above scheme, optionally, the first data authentication tag generation module further comprises a target measurement result determination submodule and a quantum key sending submodule.

[0093] The target measurement result determination sub-module is configured to receive a quantum state sent by a data sending end based on a preset quantum distribution protocol before the initial counter block is encrypted by using an AES-256 encryption algorithm and a quantum key, determine a target measurement basis corresponding to the quantum state, and determine a target measurement result corresponding to the target measurement basis.

[0094] On the basis of the above scheme, optionally, the first data authentication tag generation module comprises a data authentication tag generation sub-module. The data authentication tag generation sub-module is configured to obtain a preset authentication value, perform Galois field multiplication operation on each of the ciphertext data blocks, perform exclusive or operation on the operation result of the ciphertext data block and the preset authentication value, and obtain a data authentication tag corresponding to the ciphertext data block.

[0095] On the basis of the above scheme, optionally, the first target data block determination module can comprise a first target data block determination sub-module and a second target data block determination sub-module. The first target data block determination sub-module is configured to divide the network operation data according to a first length to obtain at least one initial data block, and in the case that the length of the initial data block reaches the first length, the initial data block is taken as a target data block. The second target data block determination sub-module is configured to, in the case that the length of the initial data block does not reach the first length, pad the initial data block to the first length according to a preset padding algorithm, and take the padded initial data block as a target data block.

[0096] The network data processing apparatus provided by the embodiment of the present application can execute the network data processing method provided by any embodiment of the present application, and has the corresponding function modules and beneficial effects of the execution method.

[0097] Embodiment five

[0098] Figure 5 A structural schematic diagram of a network data processing apparatus provided by the embodiment three of the present application is used for a data receiving end. As shown in Figure 5As shown, the device comprises: a second data authentication tag generation module 510, and a second network operation data decryption module 530. The second data authentication tag generation module 510 is configured to receive the ciphertext data block, the initialization vector and the data authentication tag corresponding to the network operation data sent by the data sending end, and generate the data authentication tag corresponding to the ciphertext data block. The second network operation data decryption module 530 is configured to, in the case that the generated data authentication tag is the same as the data authentication tag sent by the data sending end, decrypt the ciphertext data block according to the initialization vector to obtain the network operation data corresponding to the ciphertext data block.

[0099] The technical scheme of the embodiment of the application ensures the integrity and authenticity of the data by the second data authentication tag generation module 510 receiving the ciphertext data block, the initialization vector and the data authentication tag corresponding to the network operation data sent by the data sending end, and generating the data authentication tag corresponding to the ciphertext data block. In the case that the data authentication tag generated by the second data authentication tag generation module 510 is the same as the data authentication tag sent by the data sending end, the second network operation data decryption module 530 decrypts the ciphertext data block according to the initialization vector to obtain the network operation data corresponding to the ciphertext data block. This not only effectively prevents the data from being tampered with and forged, improves the security and reliability of data transmission, but also ensures the efficiency and consistency of data transmission through the standardized encryption and verification process, and improves the overall security and credibility.

[0100] On the basis of the above-mentioned scheme, optionally, the second network operation data decryption module comprises: a second initial counter block construction sub-module and a target data block obtaining sub-module. The second initial counter block construction sub-module is configured to generate a target counter value of a third length by a pre-designed number method, and construct an initial counter block according to the initialization vector and the target counter value, wherein the second length of the initialization vector and the third length are equal to the first length of the ciphertext data block. The target data block obtaining sub-module is configured to encrypt the initial counter block by using the AES-256 encryption algorithm and a quantum key to obtain a key stream corresponding to the initial counter block, and perform XOR operation on the key stream and the ciphertext data block to obtain the target data block corresponding to the ciphertext data block.

[0101] On the basis of the above-mentioned scheme, optionally, the network data processing apparatus further comprises: a target measurement result determination module, a quantum key determination module, and a quantum key saving module. The target measurement result determination module is configured to receive a quantum state sent by a data sending end based on a preset quantum distribution protocol, determine a target measurement basis corresponding to the quantum state, and determine a target measurement result corresponding to the target measurement basis. The quantum key determination module is configured to feed back the target measurement basis and the target measurement result corresponding to the target measurement basis to the data sending end, so that the data sending end determines a quantum key according to the received measurement result corresponding to the quantum state and the target measurement basis. The quantum key saving module is configured to receive the quantum key sent by the data sending end and save the quantum key.

[0102] On the basis of the above-mentioned scheme, optionally, the network data processing apparatus further comprises: a network security state module and a risk isolation response determination module. The network security state module is configured to analyze the network running data by a network security detection module after obtaining the network running data corresponding to the ciphertext data block, to obtain a network security state corresponding to the data sending end, wherein the network security detection module is obtained by training a pre-established deep learning model through sample network data. The network security state comprises a safe running state and a risk running state. The risk isolation response determination module is configured to determine a target risk type corresponding to the data sending end according to the network running data when the network security state corresponding to the data sending end is the risk running state, and determine a risk isolation response according to the target risk type, wherein the risk isolation response comprises limiting communication with the data sending end and / or starting a preset emergency response program.

[0103] The network data processing apparatus provided by the embodiments of the present application can execute the network data processing method provided by any of the embodiments of the present application, and has the corresponding function modules and beneficial effects of the execution method.

[0104] Embodiment six

[0105] Figure 6A structural diagram of an electronic device 10 that can be used to implement embodiments of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not meant to limit implementations of the present application described and / or claimed in this document.

[0106] As shown in Figure 6 The electronic device 10 includes at least one processor 11, and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., communicatively connected to the at least one processor 11, where the memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer programs stored in the read-only memory (ROM) 12 or loaded from the storage unit 18 into the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0107] Various components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc., an output unit 17, such as various types of displays, speakers, etc., a storage unit 18, such as a magnetic disk, an optical disk, etc., and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0108] The processor 11 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as a network data processing method.

[0109] In some embodiments, a network data processing method can be implemented as a computer program tangibly embodied in a computer readable storage medium, e.g., storage unit 18. In some embodiments, parts or all of the computer program can be loaded and / or installed onto electronic device 10 via, e.g., ROM 12 and / or communication unit 19. When the computer program is loaded onto RAM 13 and executed by processor 11, one or more steps of a network data processing method as described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform a network data processing method by other means, e.g., with the aid of firmware.

[0110] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (PLD), a computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0111] Computer programs used to implement the processes of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program, when executed, can implement the functions / acts specified in the flowcharts and / or block diagrams. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as part of a separate software package, or entirely on a remote machine or server.

[0112] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of a machine-readable storage medium will include one or more lines of a program of instructions in a transitory signal, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0113] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0114] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0115] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0116] It should be understood that the various forms of flow shown above can be reordered, added to, or have steps deleted. For example, the steps described in the present application can be performed in parallel, in series, or in a different order, as long as the desired results of the technical solutions of the present application can be achieved, and this is not limited herein.

[0117] The above detailed description does not constitute a limitation on the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A network data processing method, characterized by, Applied to a data sending end, comprising: Obtaining network operation data, dividing the network operation data, and determining a plurality of first length target data blocks corresponding to the network operation data according to the division result; Encrypting each target data block through an initialization vector to obtain a ciphertext data block corresponding to the target data block, and generating a data authentication tag corresponding to the ciphertext data block; Sending the ciphertext data block and the data authentication tag to a data receiving end, so that the data receiving end performs security verification on the ciphertext data block through the data authentication tag and decrypts the network operation data through the initialization vector and the ciphertext data block; Wherein, the data sending end encrypts each target data block through an initialization vector to obtain a ciphertext data block corresponding to the target data block, comprising: Obtaining a randomly generated second length initialization vector, and generating a third length target counter value through a pre-designed counter method, and constructing an initial counter block according to the initialization vector and the target counter value, wherein the length sum of the second length and the third length is equal to the first length; Using the AES-256 encryption algorithm and the quantum key to encrypt the initial counter block to obtain a key stream corresponding to the target data block, and performing XOR operation on the key stream and the target data block to obtain a ciphertext data block corresponding to the target data block; Wherein, the generation of the data authentication tag corresponding to the ciphertext data block comprises: Obtaining a preset authentication value, and performing Galois field multiplication operation on each ciphertext data block, and performing XOR operation on the operation result of the ciphertext data block and the preset authentication value to obtain a data authentication tag corresponding to the ciphertext data block.

2. The method of claim 1, wherein, Before the data sending end uses the AES-256 encryption algorithm and the quantum key to encrypt the initial counter block, it further comprises: Receiving a quantum state sent by the data sending end based on a preset quantum distribution protocol, determining a target measurement basis corresponding to the quantum state, and determining a target measurement result corresponding to the target measurement basis; Feeding back the target measurement basis and the target measurement result corresponding to the target measurement basis to the data sending end, so that the data sending end determines a quantum key according to the received measurement result corresponding to the quantum state and the target measurement basis, and sends the quantum key to the data receiving end.

3. The method of claim 1, wherein, The division of the network operation data and the determination of a plurality of first length target data blocks corresponding to the network operation data according to the division result comprise: Dividing the network operation data according to the first length to obtain at least one initial data block, and taking the initial data block as a target data block when the length of the initial data block reaches the first length; In the case where the length of the initial data block does not reach the first length, the initial data block is padded to the first length according to a preset padding algorithm, and the padded initial data block is taken as a target data block.

4. A network data processing method, characterized by, Applied to a data receiving end, comprising: The data receiving end sends the ciphertext data block, the initialization vector and the data authentication tag corresponding to the network operation data, and generates a data authentication tag corresponding to the ciphertext data block; In a case where the generated data authentication tag is the same as the data authentication tag sent by the data sending end, the ciphertext data block is decrypted according to the initialization vector to obtain network operation data corresponding to the ciphertext data block; The decryption of the ciphertext data block according to the initialization vector comprises: A third length target counter value is generated by a pre-designed counter mode, and an initial counter block is constructed according to the initialization vector and the target counter value, wherein the second length of the initialization vector and the length of the third length are equal to the first length of the ciphertext data block; The initial counter block is encrypted by using an AES-256 encryption algorithm and a quantum key to obtain a key stream corresponding to the initial counter block, and the key stream is XORed with the ciphertext data block to obtain a target data block corresponding to the ciphertext data block. The generation of the data authentication tag corresponding to the ciphertext data block comprises: A preset authentication value is obtained, and a Galois field multiplication operation is performed on each ciphertext data block, and the operation result of the ciphertext data block is XORed with the preset authentication value to obtain a data authentication tag corresponding to the ciphertext data block.

5. The method of claim 4, wherein, The decryption of the ciphertext data block according to the initialization vector comprises: A third length target counter value is generated by a pre-designed counter mode, and an initial counter block is constructed according to the initialization vector and the target counter value, wherein the second length of the initialization vector and the length of the third length are equal to the first length of the ciphertext data block; The initial counter block is encrypted by using an AES-256 encryption algorithm and a quantum key to obtain a key stream corresponding to the initial counter block, and the key stream is XORed with the ciphertext data block to obtain a target data block corresponding to the ciphertext data block.

6. The method of claim 5, wherein, Further comprising: The data sending end sends a quantum state based on a preset quantum distribution protocol, determines a target measurement basis corresponding to the quantum state, and determines a target measurement result corresponding to the target measurement basis; The target measurement basis and the target measurement result corresponding to the target measurement basis are fed back to the data sending end, so that the data sending end determines a quantum key according to the received measurement result corresponding to the quantum state and the target measurement basis; The data sending end sends the quantum key, and the quantum key is saved.

7. The method of claim 4, wherein, After obtaining the network operation data corresponding to the ciphertext data block, further comprising: The network operation data is analyzed by a network security detection module to obtain a network security state corresponding to the data sending end, wherein the network security detection module is obtained by training a pre-established deep learning model by sample network data; the network security state comprises a safe operation state and a risk operation state; In a case where the network security state corresponding to the data sending end is the risk running state, a target risk type corresponding to the data sending end is determined according to the network running data, and a risk isolation response is determined according to the target risk type, wherein the risk isolation response includes limiting communication with the data sending end and / or starting a preset emergency response program.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for causing the processor to implement the network data processing method in any one of claims 1-3 or 4-7 when executed.

Images