Data transmission method and system

Abstract

The invention relates to the technical field of communication, in particular to a data transmission method and system, a data sender generates a random encryption key, and uses a master key shared with a data receiver to safely package the random encryption key to generate key information, so that the cracking difficulty of the random encryption key is increased, and the data transmission efficiency is improved. According to the invention, even if the data frame is intercepted by an unauthorized third party in the data transmission process, the third party cannot directly obtain or use the random encryption key, so that the unauthorized access and data stealing are effectively prevented, the communication security in the data transmission process is remarkably improved, and the confidentiality and integrity of the data are protected.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a data transmission method and system. Background Art

[0002] In the process of communication between smart meters, smart terminals and master stations, in order to ensure the security of data or commands, the traditional practice is to use static encryption keys, that is, convert plaintext information into ciphertext before transmission, and the receiver uses the same key to decrypt. However, although this static key mechanism is simple, it faces the risk of being cracked due to its fixed nature. Once the attacker successfully deciphers the key through tracking, analysis, induction and probing, all subsequent communication data will face the threat of illegal decryption, tampering and re-encryption transmission, which may cause serious losses and security incidents.

[0003] To solve the above problems, the existing patent with publication number CN103685532A proposes a cloud service-based enterprise data transmission security system and method. The system uses a cloud data sharing server to dynamically generate a random encryption key to ensure that each data transmission uses a unique key, thereby significantly improving the security of data transmission. However, although this method effectively enhances data protection, in actual applications, the random key may encounter various interference factors during the transmission process, resulting in the key received by the receiver being inconsistent with the original key sent by the sender. This inconsistency will directly affect the correct use of the key, which may make the receiver unable to correctly decrypt the original data, thereby reducing the security of communication. Summary of the invention

[0004] Based on this, it is necessary to provide a data transmission method and system that can improve communication security in response to the above technical problems.

[0005] In a first aspect, the present application provides a data transmission method, the method comprising:

[0006] Step S1, the data sender generates a random encryption key;

[0007] Step S2, the data sender uses a random encryption key to encrypt the data plaintext to generate data ciphertext;

[0008] Step S3, the data sender uses the master key to encapsulate the random encryption key to generate key information;

[0009] Step S4, the data sender combines the key information and the data ciphertext into a data frame, and sends the data frame to the data receiver;

[0010] Step S5, the data recipient uses the master key to decrypt the key information and obtain a random encryption key;

[0011] Step S6: The data recipient uses the random encryption key to decrypt the data ciphertext to obtain the data plaintext.

[0012] In one embodiment, step S3 comprises:

[0013] Step S30, the data sender obtains the first key header information;

[0014] Step S31, the data sender adds the first key header information to the random encryption key, and uses the master key to encapsulate the random encryption key to which the first key header information is added, to generate key information;

[0015] Step S5 includes:

[0016] Step S50: The data receiver uses the master key to decrypt the key information and obtain the random encryption key and the second key header information;

[0017] Step S51: When the second key header information is the same as the first key header information, execute step S6.

[0018] In one embodiment, the step of generating the key information includes:

[0019] Step S310, write the first key header information to the A buffer, copy the random encryption key to the C ciphertext buffer, and initialize the maximum number of cycles;

[0020] Step S311, set the operation pointer R to point to the ciphertext buffer C, and initialize the number of small loops;

[0021] Step S312, copying the data stored in the A buffer to the B buffer;

[0022] Step S313, starting from the end position of the data currently stored in the B buffer, copy the 8 bytes pointed to by the operation pointer R;

[0023] Step S314, using the master key to perform AES encryption operation on the data currently stored in the B buffer, and copying the encryption operation result to the buffer area buffer_temp;

[0024] Step S315, copy the first 8 bytes of the data currently stored in the buffer area buffer_temp to the A buffer;

[0025] Step S316, XOR A buffer and the number of loops;

[0026] Step S317, copy the last 8 bytes of the data currently stored in the buffer area buffer_temp to the position pointed to by the operation pointer R;

[0027] Step S318, set the operation pointer R to point to the last 8 bytes of the C ciphertext buffer;

[0028] Step S319, the number of small cycles is reduced by one;

[0029] Step S320, determining whether the number of small cycles meets the small cycle end condition; if so, executing step S321, if not, returning to step S312;

[0030] Step S321, the number of major cycles is reduced by one;

[0031] Step S322, determine whether the number of large cycles meets the large cycle end condition; if so, execute step S323, if not, return to step S311;

[0032] Step S323, merge the data currently stored in the A buffer and the C ciphertext buffer, and use the merged result as the key information.

[0033] In one embodiment, the step of unsealing the key information includes:

[0034] Step S501, copy the first 8 bytes of the key information to the A buffer, and the last 16 bytes or 32 bytes to the P plaintext buffer, and initialize the number of major cycles;

[0035] Step S502, set the operation pointer R to point to the last 8 bytes of the P plaintext buffer, and initialize the number of small loops;

[0036] Step S503, copy 8 bytes of buffer A to buffer B;

[0037] Step S504, XOR the first half of the B buffer and the remaining number of loops;

[0038] Step S505, starting from the end position of the data currently stored in the B buffer, copy the 8 bytes pointed to by the operation pointer R;

[0039] Step S506, use the master key to perform AES decryption operation on the B buffer, and copy the decryption operation result to the buffer area buffer_temp;

[0040] Step S507, copy the first 8 bytes of the buffer area buffer_temp to the A buffer, and the last 8 bytes to the corresponding position of the P plaintext buffer pointed to by the operation pointer R;

[0041] Step S508, setting the operation pointer R to point to the first 8 bytes of the P plaintext buffer;

[0042] Step S509, the number of small cycles is reduced by one;

[0043] Step S510, determining whether the number of small cycles meets the small cycle end condition; if so, executing step S511, if not, returning to step S503;

[0044] Step S511, the number of major cycles is reduced by one;

[0045] Step S512, determining whether the number of large cycles meets the large cycle end condition; if so, executing step S513, if not, returning to step S502;

[0046] Step S513: Use the data currently stored in the P plaintext buffer as the decrypted random encryption key, and use the data currently stored in the A buffer as the second key header information.

[0047] In one embodiment, step S2 comprises:

[0048] Step S21, the data sender encrypts the data plaintext using a random encryption key to generate data ciphertext and a first authentication tag;

[0049] Step S4 includes:

[0050] Step S41, the data sender combines the key information, the data ciphertext and the first authentication tag into a data frame, and sends the data frame to the data receiver;

[0051] Step S6 includes:

[0052] Step S61, the data receiver uses the random encryption key to decrypt the data ciphertext to obtain the data plaintext and the second authentication tag;

[0053] Step S62: When the second authentication tag is different from the first authentication tag, the data receiver sends an error feedback to the data sender.

[0054] In one embodiment, the data frame further includes a data receiver number, and step S5 includes:

[0055] Step S52: When the data recipient number matches the data recipient, the data recipient uses the master key to decrypt the key information and obtain a random encryption key.

[0056] In one of the embodiments, the data frame further includes a frame type and a data sender number.

[0057] In a second aspect, the present application also provides a data transmission system, including a master station and a slave station connected to the master station for communication; the master station is used to generate a random encryption key, encrypt data plaintext using the random encryption key, and generate data ciphertext; the master station is also used to encapsulate the random encryption key using the master key, generate key information, and form a data frame with the key information and the data ciphertext, and send the data frame to the slave station;

[0058] The slave station is used to use the master key to decrypt the key information to obtain the random encryption key; the slave station is also used to decrypt the data ciphertext using the random encryption key to obtain the data plaintext.

[0059] In one of the embodiments, the data frame includes a slave station number, and the slave station is further configured to use a master key to decrypt the key information when the slave station number is a broadcast number or the slave station's own number.

[0060] In one embodiment, the slave station is an instrumentation product.

[0061] The above-mentioned data transmission method and data transmission system generate a random encryption key by the data sender, and use the master key shared with the data receiver to securely encapsulate the random encryption key to generate key information, thereby increasing the difficulty of cracking the random encryption key and ensuring that even if the data frame is intercepted by an unauthorized third party during transmission, the third party cannot directly obtain or use the random encryption key, effectively preventing unauthorized access and data theft, significantly improving the communication security during data transmission, and protecting the confidentiality and integrity of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 A schematic diagram of a data transmission method in one embodiment;

[0063] Figure 2 A schematic diagram of a flow chart of a data transmission method in another embodiment;

[0064] Figure 3 A schematic diagram of a process of generating key information in one embodiment;

[0065] Figure 4 A schematic diagram of a process of decrypting key information in an embodiment;

[0066] Figure 5 A schematic diagram of a flow chart of a data transmission method in another embodiment;

[0067] Figure 6 The figure is a schematic diagram of a data transmission process of a data transmission system in one embodiment. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0069] In one embodiment, Figure 1 As shown, the present application provides a data transmission method, including:

[0070] Step S1: The data sender generates a random encryption key.

[0071] Specifically, the data sender generates a random encryption key through a true random number generator. A true random number generator can generate unpredictable and non-reproducible random numbers. A new and unique encryption key is generated for each communication, and this key is only used once in the current communication process and then discarded. Even if the key is intercepted, it cannot be used to decrypt other communication data, which ensures the security of communication to the greatest extent.

[0072] Step S2: The data sender uses a random encryption key to encrypt the data plaintext to generate data ciphertext.

[0073] Specifically, after the random encryption key is generated, the data sender uses the key to encrypt the plaintext data or commands to be transmitted using a symmetric encryption algorithm (such as AES) to generate encrypted data ciphertext.

[0074] Step S3: The data sender uses the master key to encapsulate the random encryption key to generate key information.

[0075] The master key is a key shared in advance by the data sender and the data receiver. The data sender uses the master key to encapsulate the random encryption key to generate key information. The data receiver uses the master key to decapsulate the key information to obtain the random encryption key. Therefore, even if the key information is intercepted during transmission, a third party without the master key cannot decrypt and obtain the random encryption key.

[0076] Step S4: The data sender combines the key information and the data ciphertext into a data frame, and sends the data frame to the data receiver.

[0077] After encapsulating the random encryption key, the data sender combines the key information and the encrypted data ciphertext into a data frame, and then sends it to the data receiver through the network or other communication channels. This data frame contains the information to be transmitted while ensuring the security of the information.

[0078] Step S5: The data recipient uses the master key to decrypt the key information and obtain a random encryption key.

[0079] After receiving the data frame, the data receiver first uses the master key shared by both parties to decrypt the key information, thereby recovering the original random encryption key.

[0080] Step S6: The data recipient uses the random encryption key to decrypt the data ciphertext to obtain the data plaintext.

[0081] Finally, the data receiver uses the random encryption key recovered from the key information and the same symmetric encryption algorithm as the data sender to decrypt the data ciphertext and obtain the original data plaintext or command. At this point, a secure data transmission process is completed.

[0082] The data transmission method in this embodiment generates a random encryption key by the data sender, and uses the master key shared with the data receiver to securely encapsulate the random encryption key to generate key information, which increases the difficulty of cracking the random encryption key and ensures that even if the data frame is intercepted by an unauthorized third party during the data transmission process, the third party cannot directly obtain or use the random encryption key, effectively preventing unauthorized access and data theft, significantly improving the communication security during data transmission, and protecting the confidentiality and integrity of the data.

[0083] In one embodiment, Figure 2 As shown, step S3 includes:

[0084] Step S30: The data sender obtains the first key header information.

[0085] The first key header information is the key header information pre-agreed by the data sender and the data receiver, and is fixed. The data receiver can verify whether the key information remains intact and has not been tampered with during the transmission process by verifying the key header information obtained by decryption. Furthermore, the key header information can be represented by ASCII code.

[0086] In step S31, the data sender adds the first key header information to the random encryption key, and uses the master key to encapsulate the random encryption key to which the first key header information is added, to generate key information.

[0087] Specifically, the data sender adds the first key header information to the front of the random encryption key, and then uses the master key to encrypt and encapsulate the entire structure to generate key information. In this way, the key header information and the random encryption key are securely bound together, and are replaced, encrypted, and iterated together, ready to be transmitted to the data receiver.

[0088] Step S5 includes:

[0089] Step S50: The data receiver uses the master key to decrypt the key information to obtain a random encryption key and second key header information.

[0090] Specifically, the data receiver uses the master key shared with the data sender to decrypt the key information, thereby recovering the random encryption key and the additional key header information. It can be understood that, for the purpose of distinction, the key header information obtained after decryption by the data receiver is referred to as the second key header information in this embodiment.

[0091] Step S51: When the second key header information is the same as the first key header information, execute step S6.

[0092] Specifically, the data receiver compares the second key header information with the first key header information. If the two are the same, it means that there is no error or tampering in the key information during the transmission process, and the random encryption key obtained by decryption can be used for subsequent data decryption operations, that is, executing step S6; if the two are different, it indicates that the key information has been tampered with or accidentally interfered with during the transmission process, and corresponding security measures need to be taken, such as sending a response error frame to the data sender.

[0093] The data transmission method in this embodiment, by adding key header information to the front of the random encryption key, not only enhances the security of key transmission, but also provides an effective verification mechanism for the integrity and correctness of the key information.

[0094] In one embodiment, Figure 3 As shown, the steps of generating key information include:

[0095] Step S310, write the first key header information to the A buffer, copy the random encryption key to the C ciphertext buffer, and initialize the maximum number of cycles.

[0096] The first key header information and the A buffer each include 8 bytes, and the C ciphertext buffer includes 32 bytes. The random encryption key may include 16 bytes or 32 bytes, and the maximum number of cycles is initialized to 6 times.

[0097] Step S311, set the operation pointer R to point to the C ciphertext buffer, and initialize the number of small loops.

[0098] The initial value of the number of small cycles is a preset number of small cycles, which is determined according to the number of bytes of the random encryption key. Specifically, when the random encryption key includes 16 bytes, the initial value of the number of small cycles is 2; when the random encryption key includes 32 bytes, the initial value of the number of small cycles is 4.

[0099] Step S312, copy the data stored in the A buffer to the B buffer.

[0100] Specifically, the 8 bytes stored in the A buffer are copied to the B buffer, and the B buffer includes 16 bytes.

[0101] Step S313, starting from the end position of the data currently stored in the B buffer, copy the 8 bytes pointed to by the operation pointer R.

[0102] Specifically, the 8 bytes pointed to by the operation pointer R are copied to the back of the data currently stored in the B buffer.

[0103] Step S314, using the master key to perform AES encryption operation on the data currently stored in the B buffer, and copy the encryption operation result to the buffer area buffer_temp.

[0104] Specifically, the master key is used to perform AES (ECB mode) encryption operation on the data currently stored in the B buffer, and the encryption operation result is copied to the buffer area buffer_temp. Among them, AES (ECB (Electronic Codebook) mode) is a basic encryption mode of the AES algorithm. In ECB mode, the AES algorithm first divides the plaintext into several fixed-size blocks, usually each block is 128 bits (i.e., 16 bytes). If the length of the plaintext is not an integer multiple of the block size, padding (such as PKCS#5 or PKCS#7 padding) is required to ensure that the size of the last block meets the requirements. Next, the same key, i.e., the master key, is used to perform independent encryption operations on each plaintext block. Since each block is encrypted independently, the same plaintext block will obtain the same ciphertext block after encryption. Finally, all encrypted ciphertext blocks are concatenated in sequence to form the final encryption result.

[0105] Step S315, copy the first 8 bytes of the data currently stored in the buffer area buffer_temp to the A buffer.

[0106] The data currently stored in the buffer area buffer_temp is the current encryption result.

[0107] Step S316, XOR the A buffer and the number of loops.

[0108] The number of cycles is the number of times the current small cycle has been executed. Specifically, the data currently stored in the A buffer is XORed with the number of cycles, and the XOR result is updated to the A buffer.

[0109] Step S317, copy the last 8 bytes of the data currently stored in the buffer area buffer_temp to the position pointed to by the operation pointer R.

[0110] Specifically, the last 8 bytes of the encryption result currently stored in the buffer area buffer_temp are copied to the C ciphertext buffer location pointed to by the operation pointer R.

[0111] Step S318, set the operation pointer R to point to the last 8 bytes of the C ciphertext buffer.

[0112] Specifically, the operation pointer R is set to point to the next 8-byte position of the C ciphertext buffer.

[0113] Step S319, the number of small loops is reduced by one.

[0114] Step S320, determine whether the number of small cycles meets the small cycle end condition. If yes, execute step S321, if not, return to step S312.

[0115] The small loop end condition may be that the number of small loops decreases to 0.

[0116] Step S321, the number of major cycles is reduced by one.

[0117] Step S322, determine whether the number of large cycles meets the large cycle end condition. If yes, execute step S323, if not, return to step S311.

[0118] Step S323, merge the data currently stored in the A buffer and the C ciphertext buffer, and use the merged result as the key information. The end condition of the large loop can be that the number of large loops decreases to 0. After the large loop and the small loop are completed, the final data in the A buffer and the C ciphertext buffer are merged.

[0119] This embodiment realizes complex transformation and enhancement of random encryption keys by combining multiple technical means such as loop iteration, data replication, AES encryption and XOR operation. This processing method not only increases the complexity and unpredictability of encryption keys, but also ensures the stability and reliability of the key generation process through multiple cycles. The key information finally generated not only contains the characteristics of the original key, but also enhances its security through multi-step nonlinear transformation, effectively improving communication security.

[0120] In one embodiment, Figure 4 As shown, the steps of decrypting the key information include:

[0121] Step S501, copy the first 8 bytes of the key information to the A buffer, and the last 16 bytes or 32 bytes to the P plaintext buffer, and initialize the maximum number of loops.

[0122] The initial value of the number of major cycles is 6, which is the same as the initial value of the number of major cycles in the key information generation step. Specifically, when the random encryption key is 16 bytes, the first 8 bytes of the key information are copied to the A buffer, and the last 16 bytes are copied to the P plaintext buffer; when the random encryption key is 32 bytes, the first 8 bytes of the key information are copied to the A buffer, and the last 32 bytes are copied to the P plaintext buffer.

[0123] Step S502, set the operation pointer R to point to the last 8 bytes of the P plaintext buffer, and initialize the number of small cycles. The initial value of the number of small cycles is the same as the initial value of the number of small cycles in the key information generation step, and can also be determined according to the number of bytes of the random encryption key. Specifically, when the random encryption key includes 16 bytes, the initial value of the number of small cycles is 2; when the random encryption key includes 32 bytes, the initial value of the number of small cycles is 4.

[0124] Step S503, copy the 8 bytes of the A buffer to the B buffer.

[0125] Step S504, XOR the first half of the B buffer and the remaining number of cycles. The remaining number of cycles is the number of cycles remaining after deducting the number of cycles completed from the total number of cycles. When performing key encapsulation, the total number of cycles can be understood as the total number of encryptions, and when performing key decryption, the total number of cycles can be understood as the total number of decryptions. Specifically, the total number of cycles is the product of a preset initial value of the large number of cycles and a preset initial value of the small number of cycles.

[0126] Step S505, starting from the end position of the data currently stored in the B buffer, copy the 8 bytes pointed to by the operation pointer R.

[0127] Step S506, use the master key to perform AES decryption operation on the B buffer, and copy the decryption operation result to the buffer area buffer_temp.

[0128] Step S507, copy the first 8 bytes of the buffer area buffer_temp to the A buffer, and the last 8 bytes to the corresponding position of the P plaintext buffer pointed to by the operation pointer R.

[0129] Among them, step S503 to step S507 mainly realizes the gradual decryption and reconstruction of the encryption key. In each small cycle, first, 8 bytes of the A buffer are copied to the B buffer, and the B buffer can be regarded as a temporary storage. Then the first half of the B buffer, that is, the first 8 bytes, are XORed with the current remaining number of cycles, and the XOR result is updated to the first half of the B buffer. Next, starting from the end position of the data currently stored in the B buffer, copy the 8 bytes of the P plaintext buffer pointed to by the operation pointer R. Subsequently, the master key is used to perform AES (ECB mode) decryption operation on the data currently stored in the B buffer, and the decryption result is divided into two parts: the first 8 bytes are used to update the content of the A buffer, and the second 8 bytes replace the part pointed to by the operation pointer R in the P plaintext buffer.

[0130] Step S508, set the operation pointer R to point to the first 8 bytes of the P plaintext buffer.

[0131] Specifically, each time a small loop is completed, the position of the operation pointer R is adjusted to point to the first 8 bytes of the P plaintext buffer to prepare for the next loop.

[0132] Step S509, the number of small cycles is reduced by one;

[0133] Step S510, determine whether the number of small cycles meets the small cycle end condition. If yes, execute step S511, if no, return to step S503. The small cycle end condition can be that the number of small cycles decreases to 0.

[0134] Step S511, the number of major cycles is reduced by one;

[0135] Step S512, determine whether the number of large cycles meets the large cycle end condition. If yes, execute step S513, if not, return to step S502. The large cycle end condition can be that the number of large cycles decreases to 0.

[0136] Step S513: Use the data currently stored in the P plaintext buffer as the decrypted random encryption key, and use the data currently stored in the A buffer as the second key header information.

[0137] Furthermore, the data receiver determines whether the second key header information is the same as the first key header information; if so, the data ciphertext is decrypted using the unsealed random encryption key to obtain the data plaintext; if not, a response error frame is sent to the data sender.

[0138] In one embodiment, Figure 5 As shown, step S2 includes:

[0139] In step S21, the data sender encrypts the data plaintext using a random encryption key to generate data ciphertext and a first authentication tag.

[0140] Specifically, the data sender uses a random encryption key and adopts the AES-GCM algorithm (Advanced Encryption Standard-Galois / Counter Mode) to encrypt the data plaintext to generate data ciphertext and the first authentication tag. AES-GCM is a symmetric encryption algorithm and belongs to the AEAD (Authenticated Encryption with Associated Data) mode. It combines the CTR (Counter) mode of AES and the GM AC (Galois / Message Authentication) for hash calculation, provides encryption and integrity verification of messages, and can also provide integrity verification of additional messages. Among them, the first authentication tag can be the additional information.

[0141] Step S4 includes:

[0142] In step S41, the data sender combines the key information, the data ciphertext and the first authentication tag into a data frame, and sends the data frame to the data receiver.

[0143] Step S6 includes:

[0144] Step S61: The data receiver uses a random encryption key to decrypt the data ciphertext to obtain the data plaintext and a second authentication tag.

[0145] Specifically, the data receiver uses a random encryption key and adopts the same AES-GCM algorithm as the data sender to decrypt the data ciphertext to obtain the data plaintext and the second authentication tag.

[0146] Step S62: When the second authentication tag is different from the first authentication tag, the data receiver sends an error feedback to the data sender.

[0147] Specifically, the second authentication tag calculated in step S61 is compared with the first authentication tag sent by the data sender. When the comparison result shows that the two are the same, the data receiver reads and writes the corresponding data or executes the corresponding command; when the comparison result shows that the two are different, the data receiver sends error feedback to the data sender, such as sending a response error frame to the data sender.

[0148] This embodiment adds an authentication tag during data transmission, making it easier for the data receiver to determine whether the acquired data has been interfered with or tampered with, thereby further improving communication security.

[0149] In one embodiment, the data frame further includes a data receiver number, and step S5 includes:

[0150] Step S52: When the data recipient number matches the data recipient, the data recipient uses the master key to decrypt the key information and obtain a random encryption key.

[0151] Specifically, the data receiver compares its own number with the data receiver number in the acquired data frame. If the two are the same, it indicates that the data frame is indeed sent to the current data receiver, and then the subsequent key information unsealing, data ciphertext decryption and other steps are performed; if the two are different, the data receiver can choose to ignore the data frame, or send an error response to the sender. Furthermore, other identity identifiers can be used to replace the data receiver number, as long as they can uniquely identify the data receiver.

[0152] This embodiment adds the data recipient number to the data frame to ensure that the data can be accurately processed by the intended recipient, thereby increasing the targeting and security of the data transmission process and further improving communication security.

[0153] In one embodiment, the data frame further includes a frame type and a data sender number.

[0154] The frame type is a command code, which is a fixed value. After the data receiver obtains the data frame, it knows that the frame is a key encapsulation type data frame through the frame type in the data frame, and then performs the subsequent key decapsulation step. In addition, other identity identifiers can be used to replace the data sender number, as long as they can uniquely identify the data sender.

[0155] Furthermore, after obtaining the data sender number, the data receiver can first verify whether the data sender number is consistent with its own preset receiver number. If not, the data receiver can choose to ignore the data frame or send an error response to the data sender. In addition, the data receiver can also verify whether the frame type is a key encapsulation type data frame. If so, perform subsequent key decapsulation processing. If not, perform corresponding processing.

[0156] This embodiment effectively improves the processing speed of the data frame by the data receiver by adding a frame type to the data frame, and the setting of the data sender number helps the receiver to verify the reliability of the data source.

[0157] In one embodiment, a data transmission system is also provided, including a master station and a slave station communicatively connected to the master station; the master station is used to generate a random encryption key, encrypt data plaintext using the random encryption key, and generate data ciphertext; the master station is also used to encapsulate the random encryption key using the master key, generate key information, and combine the key information and data ciphertext into a data frame, and send the data frame to the slave station.

[0158] The slave station is used to use the master key to decrypt the key information to obtain the random encryption key; the slave station is also used to decrypt the data ciphertext using the random encryption key to obtain the data plaintext.

[0159] Specifically, Figure 6 As shown in the figure, before the master and slave start formal data transmission, both parties need to establish a secure communication link. This process uses the standard application layer link establishment method and authenticates and exchanges information between the two parties through a symmetric encryption algorithm. The master first sends a ciphertext and authentication tag containing information such as the protocol version, function, buffer size, etc. that it supports to the slave. After the slave decrypts and verifies this information, it sends its own relevant information in the same way to respond to the master, completing the function and communication buffer negotiation between the two parties.

[0160] In each frame communication after the communication link is successfully established, each frame uses a different random encryption key. Specifically, the master station will instantly generate a random encryption key, and use this random encryption key to encrypt the plaintext of the data or command to be sent. Among them, the random encryption key can be generated by a true random number generator. Subsequently, the master station will use a master key to encapsulate the random encryption key just generated to form a ciphertext, and send it to the slave station together with the data ciphertext and the authentication tag. Optionally, the key information generation algorithm in the above embodiment can be used to encapsulate the random encryption key, or other key encapsulation algorithms can be used for encapsulation. After receiving this information, the slave station first uses the master key to unseal the encapsulated random encryption key ciphertext to restore the plaintext of the random encryption key. Then, using this random encryption key, the slave station can decrypt the ciphertext of the data or command, thereby obtaining the original plaintext information. In particular, each random encryption key is unknown before it is generated, is generated instantly by a true random number generator, and is only used once in the frame communication, and then is discarded. The next frame of data will use the newly generated random encryption key, which greatly enhances the security of communication.

[0161] Furthermore, in order to ensure the security and accuracy during the key transmission process, before the random encryption key is encapsulated, a specific key header information "WASION01" is pre-added to the random encryption key, and then the entire combination is subjected to complex permutation, encryption and iterative operations to ensure that the encapsulated key ciphertext is both invisible and difficult to tamper with. When the slave station unseals the key, it will first verify the correctness of the key header information "WASION01", which is used as a means of verifying the correct transmission and unsealing of the key, further improving the security and reliability of the entire communication process. Among them, the key header information is represented by ASCII code. Optionally, other information can also be attached to the front of the random encryption key to replace the key header information of this embodiment.

[0162] The specific steps for the master station to generate random encryption keys, encrypt plaintext, encapsulate keys, and compose frames are as follows:

[0163] 1. The master station uses a true random number generator to temporarily generate a random encryption key EKh1;

[0164] 2. The master station uses the random encryption key EKh1 to encrypt the plain text data or commands issued using a symmetric encryption algorithm to generate data or command ciphertext and authentication tags;

[0165] 3. The master station uses the key encapsulation algorithm and the master key to encapsulate the encryption key EKh1 and generate the encapsulated key information; the specific steps of the key encapsulation algorithm can refer to the steps in which the data sender uses the master key to encapsulate the random encryption key and generate the key information in the above embodiment, which will not be repeated here.

[0166] 4. The master station forms a request data frame according to the data items in the table below and sends it to the instrument through the communication network:

[0167] Frame Type Master station number Slave number EKh1 after packaging The ciphertext of the data sent Certification label issued

[0168] The slave determines whether the slave number in the received master request data frame is its own or a general broadcast. If so, it performs the following steps of decrypting the key, decrypting the data ciphertext, authenticating, generating a random encryption key, encrypting the plaintext, encapsulating the key, and framing, including:

[0169] 1. The slave station uses the master key to decapsulate the encapsulated random encryption key information, obtains the plain text of the random encryption key EKh1, and verifies whether the decapsulated key header information is the agreed identification value WASION01. If it is consistent, it means that the master station encapsulation is normal, and the encryption key information has not been tampered with or accidentally interfered with during the transmission process. The decapsulated random encryption key is the same as that of the master station, then the subsequent data ciphertext decryption steps are executed, otherwise the error frame is responded to the master station;

[0170] 2. The slave station uses the random encryption key EKh1 obtained after unsealing, and adopts the same symmetric key algorithm as the master station to decrypt the received data ciphertext, obtain the data plaintext and the authentication tag (corresponding to the second authentication tag in the above embodiment), and then compares it with the received authentication tag (corresponding to the first authentication tag in the above embodiment). If the data ciphertext is artificially tampered with or unintentionally interfered during the transmission process, the authentication tags will be unequal, and the slave station responds with an error frame to the master station. Otherwise, the comparison result of the authentication tags is equal, indicating that the data transmission is normal, and the decrypted data plaintext is the same as that of the master station, so the corresponding data can be read and written or the corresponding command can be executed, and then the slave station prepares the plaintext for the response;

[0171] 3. The slave station uses a true random number generator to temporarily generate its own random encryption key EKm1;

[0172] 4. The slave station uses this random encryption key EKm1 to encrypt its own response data plaintext or command execution result using a symmetric encryption algorithm to generate the response data ciphertext and the response authentication tag;

[0173] 5. The slave uses the same key encapsulation algorithm and master key to encapsulate the random encryption key EKm1 and generate encapsulated key information;

[0174] 6. If it is not a broadcast, the slave station forms a response data frame according to the data items in the following table and responds to the master station through the communication network:

[0175] Frame Type Slave number Master station number EKm1 after packaging Response data ciphertext Authentication tag of the response

[0176] After the master station receives the slave station response data frame, similar to the slave station processing method described above, the master station also first unseals the key, then decrypts the data ciphertext, and then authenticates the authentication tag. After all steps are passed, the slave station response data plaintext or command execution result can be obtained. The master station and the slave station continue to communicate and interact with other subsequent data. The generation and encapsulation, framing, and unsealing of the new random encryption key are the same as described above, until all data and command operations are completed, and the master station releases the link with the slave station.

[0177] The data transmission system provided in this embodiment generates a random encryption key through a master station, and uses a master key shared with a slave station to securely encapsulate the random encryption key to generate key information, thereby ensuring that even if the random encryption key is intercepted by an unauthorized third party during the data transmission process, the third party cannot directly obtain or use the random encryption key, thereby effectively preventing unauthorized access and data theft, significantly improving the communication security during the data transmission process, and protecting the confidentiality and integrity of the data.

[0178] In one embodiment, the slave station is an instrumentation product.

[0179] Specifically, when the slave station is an instrument product, the format of the request data frame sent by the master station is:

[0180] Frame Type Master station number Instrument No. EKh1 after packaging The ciphertext of the data sent Certification label issued

[0181] The format of the response data frame sent by the instrumentation product is:

[0182] Frame Type Instrument No. Master station number EKm1 after packaging Response data ciphertext Authentication tag of the response

[0183] The data transmission system of this embodiment supports sending data and instructions to multiple instruments in parallel. To achieve this function, it is only necessary to uniformly set the instrument number to a universal broadcast number. When receiving information, each instrument can decrypt the information according to its corresponding random encryption key, thereby significantly improving communication efficiency and ensuring the accuracy of information. At the same time, in order to further enhance communication security, the system uses a unique random encryption key in each frame of data transmission and response, making each communication unpredictable and greatly improving the security strength of communication. In addition, the data transmission system fully considers the computing efficiency in its design, ensuring low computing volume and short computing time, so that the entire communication process responds quickly.

[0184] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0185] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A data transmission method, characterized in that: The method comprises: Step S1, the data sender generates a random encryption key; Step S2, the data sender uses the random encryption key to encrypt the data plaintext to generate data ciphertext; Step S3, the data sender uses the master key to encapsulate the random encryption key to generate key information; Step S4, the data sender combines the key information and the data ciphertext into a data frame, and sends the data frame to the data receiver; Step S5, the data recipient uses the master key to decrypt the key information to obtain the random encryption key; Step S6: The data recipient uses the random encryption key to decrypt the data ciphertext to obtain the data plaintext.

2. The data transmission method according to claim 1, characterized in that: The step S3 comprises: Step S30, the data sender obtains the first key header information; Step S31, the data sender adds the first key header information to the random encryption key, and uses the master key to encapsulate the random encryption key to which the first key header information is added, to generate the key information; The step S5 comprises: Step S50, the data receiving party uses the master key to decrypt the key information to obtain the random encryption key and the second key header information; Step S51: When the second key header information is the same as the first key header information, execute step S6.

3. The data transmission method according to claim 2, characterized in that: The step of generating the key information comprises: Step S310, writing the first key header information to the A buffer, copying the random encryption key to the C ciphertext buffer, and initializing the maximum number of cycles; Step S311, setting the operation pointer R to point to the C ciphertext buffer, and initializing the number of small loops; Step S312, copying the data stored in the A buffer to the B buffer; Step S313, starting from the end position of the data currently stored in the B buffer, copy the 8 bytes pointed to by the operation pointer R; Step S314, using the master key to perform AES encryption operation on the data currently stored in the B buffer, and copying the encryption operation result to the buffer area buffer_temp; Step S315, copying the first 8 bytes of the data currently stored in the buffer area buffer_temp to the A buffer; Step S316, XOR the A buffer and the number of loops; Step S317, copy the last 8 bytes of the data currently stored in the buffer area buffer_temp to the position pointed to by the operation pointer R; Step S318, setting the operation pointer R to point to the last 8 bytes of the C ciphertext buffer; Step S319, the number of small cycles is reduced by one; Step S320, determining whether the number of small cycles meets the small cycle end condition; if so, executing step S321, if not, returning to step S312; Step S321, the number of major cycles is reduced by one; Step S322, determining whether the large cycle times meet the large cycle end condition; if so, executing step S323, if not, returning to step S311; Step S323, merging the data currently stored in the A buffer and the C ciphertext buffer, and using the merging result as the key information.

4. The data transmission method according to claim 2, characterized in that: The step of decrypting the key information comprises: Step S501, copy the first 8 bytes of the key information to the A buffer, and the last 16 bytes or 32 bytes to the P plaintext buffer, and initialize the number of major cycles; Step S502, setting the operation pointer R to point to the last 8 bytes of the P plaintext buffer, and initializing the number of small loops; Step S503, copying 8 bytes of the A buffer to the B buffer; Step S504, XOR the first half of the B buffer and the remaining number of loops; Step S505, starting from the end position of the data currently stored in the B buffer, copy the 8 bytes pointed to by the operation pointer R; Step S506, using the master key to perform AES decryption operation on the B buffer, and copying the decryption operation result to the buffer area buffer_temp; Step S507, copy the first 8 bytes of the buffer area buffer_temp to the A buffer, and the last 8 bytes to the corresponding position of the P plaintext buffer pointed to by the operation pointer R; Step S508, setting the operation pointer R to point to the first 8 bytes of the P plaintext buffer; Step S509, the number of small cycles is reduced by one; Step S510, determining whether the number of small cycles meets the small cycle end condition; if so, executing step S511, if not, returning to step S503; Step S511, the number of major cycles is reduced by one; Step S512, determining whether the large cycle times meet the large cycle end condition; if so, executing step S513, if not, returning to step S502; Step S513: Use the data currently stored in the P plaintext buffer as the decrypted random encryption key, and use the data currently stored in the A buffer as the second key header information.

5. The data transmission method according to claim 1, characterized in that: The step S2 comprises: Step S21, the data sender encrypts the data plaintext using the random encryption key to generate the data ciphertext and a first authentication tag; The step S4 comprises: Step S41, the data sender combines the key information, the data ciphertext and the first authentication tag into a data frame, and sends the data frame to the data receiver; The step S6 comprises: Step S61, the data recipient uses the random encryption key to decrypt the data ciphertext to obtain the data plaintext and a second authentication tag; Step S62: When the second authentication tag is different from the first authentication tag, the data receiver sends an error feedback to the data sender.

6. The data transmission method according to claim 5, characterized in that: The data frame also includes a data receiver number, and step S5 includes: Step S52: When the data recipient number matches the data recipient, the data recipient uses the master key to decrypt the key information to obtain the random encryption key.

7. The data transmission method according to claim 6, characterized in that: The data frame also includes a frame type and a data sender number.

8. A data transmission system, characterized in that: The method comprises a master station and a slave station connected to the master station in communication; the master station is used to generate a random encryption key, and use the random encryption key to encrypt data plaintext to generate data ciphertext; the master station is also used to encapsulate the random encryption key using the master key to generate key information, and form a data frame with the key information and the data ciphertext, and send the data frame to the slave station; The slave station is used to decrypt the key information using the master key to obtain the random encryption key; The slave station is also used to decrypt the data ciphertext using the random encryption key to obtain the data plaintext.

9. The data transmission system according to claim 8, characterized in that: The data frame includes a slave station number, and the slave station is further configured to use the master key to deseal the key information when the slave station number is a broadcast number or the slave station's own number.

10. The data transmission system according to claim 8, characterized in that: The slave station is an instrument product.

Images