Data transmission method, electronic equipment, storage medium and program product

Abstract

The embodiment of the invention provides a data transmission method, electronic equipment, a storage medium and a program product. The method comprises the following steps: acquiring timestamp information and to-be-encrypted transmission data; according to an HKDF key derivation algorithm, a first dynamic derived key is determined according to the timestamp information and a first identifier of a sending end device; performing encryption processing on the to-be-encrypted transmission data according to the first dynamic derived key to obtain target encrypted data; and sending the target encrypted data, the timestamp information and the first identifier of the sending end equipment to the receiving end equipment. According to the embodiment of the invention, a dynamic encryption scheme based on an HKDF key derivation algorithm is used for protecting end-to-end authentication and transmission and storage data encryption, the deployment project amount is simplified, and meanwhile, the data transmission and storage security is ensured.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a data transmission method, electronic equipment, storage medium and program product. Background Art

[0002] With the popularization of the Internet, the data flow interaction between various network devices and mobile devices is increasing, and network security issues are gradually being taken seriously by major network companies. In a complete data interaction process, the security and reliability of applications that carry data transmission, reception, processing and other operations are extremely important.

[0003] In traditional end-to-end interactions, digital certificate management systems need to be deployed simultaneously to protect the security of data encryption keys, and the deployment workload is large. At the message sending end, the message data is encrypted by summary, concatenation and key encryption to obtain encrypted messages and encryption keys; the encrypted messages and encryption keys are sent to the message receiving end; at the message receiving end, the received encrypted messages and encryption keys are decrypted respectively, and the messages are verified according to the decryption results; in this process, a multi-layer verification mechanism is required, which is to replace the digital certificate with an asymmetric key. The security of the asymmetric key itself is difficult to guarantee. Although the use of asymmetric keys to protect encryption keys can reduce the engineering of deploying digital certificate management systems, it also loses the verification of the security and reliability of the asymmetric key itself. When the asymmetric key cannot guarantee security, the encryption key cannot be guaranteed to be leaked. How to improve the security of data transmission is an urgent problem to be solved. Summary of the invention

[0004] The purpose of some embodiments of the present application is to provide a data transmission method, an electronic device, a storage medium and a program product. Through the technical scheme of the embodiments of the present application, by obtaining timestamp information and data to be encrypted for transmission; determining a first dynamic derived key according to the HKDF key derivation algorithm, according to the timestamp information and a first identifier of a sending device; encrypting the data to be encrypted for transmission according to the first dynamic derived key to obtain target encrypted data; and sending the target encrypted data, the timestamp information and the first identifier of the sending device to a receiving device, the embodiments of the present application use a dynamic encryption scheme based on the HKDF key derivation algorithm to protect end-to-end authentication, transmission and storage data encryption, simplify the deployment workload, and ensure the security of data transmission and storage.

[0005] In a first aspect, some embodiments of the present application provide a data transmission method, applied to a sending end device, including:

[0006] Obtain timestamp information and data to be encrypted for transmission;

[0007] Determine a first dynamically derived key according to the HKDF key derivation algorithm and the timestamp information and the first identifier of the sending end device;

[0008] Encrypting the to-be-encrypted transmission data according to the first dynamically derived key to obtain target encrypted data;

[0009] The target encrypted data, the timestamp information and the first identifier of the sending device are sent to the receiving device. Some embodiments of the present application adopt the HKDF key derivation algorithm, combined with the timestamp, to dynamically generate encryption keys during data transmission to achieve dynamic encryption, thereby ensuring the security of end-to-end data interaction, using a dynamic encryption scheme based on the HKDF key derivation algorithm to protect end-to-end authentication, transmission and storage data encryption, simplifying the deployment workload while ensuring data transmission and storage security.

[0010] Optionally, the first dynamically derived key is obtained in the following manner:

[0011] Determine a first derived key based on the HKDF key derivation algorithm and according to the first identifier of the sending end device;

[0012] Using a preset encryption and decryption algorithm, decrypting the pre-authenticated port command ciphertext according to the first derived key to obtain password data;

[0013] Based on the HKDF key derivation algorithm, a first dynamically derived key is determined according to the timestamp information, the password data and the first identifier of the sending device.

[0014] Some embodiments of the present application use a symmetric encryption algorithm, and utilize SM4 keys and SM4ECB algorithms to encrypt and store local data, thereby improving the security of local data storage.

[0015] Optionally, the method further comprises:

[0016] Generate a first identification of the sending end device according to the password data;

[0017] Based on the HKDF key derivation algorithm, generating a first derived key according to the first identifier of the sending end device;

[0018] Using a preset encryption and decryption algorithm, encrypting the password data according to the first derived key to obtain the port command ciphertext;

[0019] The port command ciphertext and the first identifier of the sending end device are stored.

[0020] Some embodiments of the present application complete the dynamic derivation of end-to-end data encryption keys based on the HKDF key derivation algorithm to ensure end-to-end data security.

[0021] Optionally, the preset encryption and decryption algorithm includes at least an SM4ECB algorithm.

[0022] Some embodiments of the present application use the HKDF key derivation algorithm, combined with a timestamp, to dynamically generate encryption keys during data transmission, implement dynamic encryption, and ensure the security of end-to-end data interaction.

[0023] In a second aspect, some embodiments of the present application provide a data transmission method, applied to a receiving device, including:

[0024] Receiving target encrypted data, timestamp information and a first identifier of the sending end device sent by the sending end device;

[0025] Obtaining a second identifier of the receiving end device and a port command ciphertext, wherein the port command message is obtained through registration of the sending end device and the receiving end device;

[0026] Based on the HKDF key derivation algorithm, generating a second derived key according to the second identifier of the receiving end device;

[0027] Based on a preset encryption and decryption algorithm, decrypt the port command ciphertext according to the second derived key to obtain password data;

[0028] Based on the HKDF key derivation algorithm, generate a second dynamic derived key according to the password data, the second identifier of the receiving device and the timestamp information;

[0029] The target encrypted data is decrypted according to the second dynamically derived key and the preset encryption and decryption algorithm to obtain the data to be encrypted for transmission.

[0030] Some embodiments of the present application use a dynamic encryption scheme based on the HKDF key derivation algorithm to protect end-to-end authentication, transmission and storage data encryption, simplify the deployment workload, and ensure the security of data transmission and storage.

[0031] Optionally, the method further comprises:

[0032] It is determined that the second identifier of the receiving device has been registered.

[0033] Optionally, the method further comprises:

[0034] Registering is performed on the receiving device according to the first identification and password data of the sending device.

[0035] Some embodiments of the present application have strong security because encryption keys are dynamically generated based on the HKDF key derivation algorithm according to timestamps during transmission, thereby achieving dynamic data encryption and ensuring data security and key security.

[0036] In a third aspect, some embodiments of the present application provide a data transmission device, applied to a sending end device, including:

[0037] An acquisition module, used to obtain timestamp information and data to be encrypted for transmission;

[0038] A determination module, configured to determine a first dynamically derived key according to an HKDF key derivation algorithm, according to the timestamp information and a first identifier of a sending end device;

[0039] An encryption module, used for encrypting the to-be-encrypted transmission data according to the first dynamically derived key to obtain target encrypted data;

[0040] The sending module is used to send the target encrypted data, the timestamp information and the first identifier of the sending device to the receiving device.

[0041] Some embodiments of the present application adopt the HKDF key derivation algorithm in combination with a timestamp to dynamically generate encryption keys during data transmission, thereby achieving dynamic encryption and ensuring the security of end-to-end data interaction. A dynamic encryption scheme based on the HKDF key derivation algorithm is used to protect end-to-end authentication, transmission, and storage data encryption, thereby simplifying the deployment workload while ensuring data transmission and storage security.

[0042] Optionally, the first dynamically derived key is obtained in the following manner:

[0043] Determine a first derived key based on the HKDF key derivation algorithm and according to the first identifier of the sending end device;

[0044] Using a preset encryption and decryption algorithm, decrypting the pre-authenticated port command ciphertext according to the first derived key to obtain password data;

[0045] Based on the HKDF key derivation algorithm, a first dynamically derived key is determined according to the timestamp information, the password data and the first identifier of the sending device.

[0046] Some embodiments of the present application use a symmetric encryption algorithm, and utilize SM4 keys and SM4ECB algorithms to encrypt and store local data, thereby improving the security of local data storage.

[0047] Optionally, the acquisition module is used to:

[0048] Generate a first identification of the sending end device according to the password data;

[0049] Based on the HKDF key derivation algorithm, generating a first derived key according to the first identifier of the sending end device;

[0050] Using a preset encryption and decryption algorithm, encrypting the password data according to the first derived key to obtain the port command ciphertext;

[0051] The port command ciphertext and the first identifier of the sending end device are stored.

[0052] Some embodiments of the present application complete the dynamic derivation of end-to-end data encryption keys based on the HKDF key derivation algorithm to ensure end-to-end data security.

[0053] Optionally, the preset encryption and decryption algorithm includes at least an SM4ECB algorithm.

[0054] Some embodiments of the present application use the HKDF key derivation algorithm, combined with a timestamp, to dynamically generate encryption keys during data transmission, implement dynamic encryption, and ensure the security of end-to-end data interaction.

[0055] In a fourth aspect, some embodiments of the present application provide a data transmission device, including:

[0056] A receiving module, used for receiving target encrypted data, timestamp information and a first identifier of the sending device sent by a sending device;

[0057] A processing module, used to obtain a second identifier of a receiving end device and a port command ciphertext, wherein the port command message is obtained through registration of a sending end device and a receiving end device;

[0058] A derivation module, configured to generate a second derived key based on the HKDF key derivation algorithm and according to the second identifier of the receiving end device;

[0059] A decryption module, used to decrypt the port command ciphertext according to the second derived key based on a preset encryption and decryption algorithm to obtain password data;

[0060] A generating module, configured to generate a second dynamically derived key based on the HKDF key derivation algorithm according to the password data, the second identifier of the receiving end device and the timestamp information;

[0061] The recovery module is used to decrypt the target encrypted data according to the second dynamically derived key and the preset encryption and decryption algorithm to obtain the data to be encrypted for transmission.

[0062] Some embodiments of the present application use a dynamic encryption scheme based on the HKDF key derivation algorithm to protect end-to-end authentication, transmission and storage data encryption, simplify the deployment workload, and ensure the security of data transmission and storage.

[0063] Optionally, the recovery module is used to:

[0064] It is determined that the second identifier of the receiving device has been registered.

[0065] Optionally, the device further comprises a registration module, wherein the registration module is configured to:

[0066] Registering is performed on the receiving device according to the first identification and password data of the sending device.

[0067] Some embodiments of the present application have strong security because encryption keys are dynamically generated based on the HKDF key derivation algorithm according to timestamps during transmission, thereby achieving dynamic data encryption and ensuring data security and key security.

[0068] In a fifth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, the data transmission method as described in any embodiment of the first aspect or the second aspect can be implemented.

[0069] In a sixth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the data transmission method as described in any embodiment of the first aspect or the second aspect.

[0070] In a seventh aspect, some embodiments of the present application provide a computer program product, comprising a computer program, wherein the computer program, when executed by a processor, can implement the data transmission method as described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0072] Figure 1 A flowchart of a data transmission method provided in an embodiment of the present application;

[0073] Figure 2 A flowchart of another data transmission method provided in an embodiment of the present application;

[0074] Figure 3 A schematic diagram of the process flow after the sending end is initialized provided in an embodiment of the present application;

[0075] Figure 4 A schematic diagram of the receiving end authentication process provided in the embodiment of the present application;

[0076] Figure 5 A schematic diagram of a data transmission flow at a transmitting end provided in an embodiment of the present application;

[0077] Figure 6 A schematic diagram of a data transmission process at a receiving end provided in an embodiment of the present application;

[0078] Figure 7 A schematic diagram of the structure of a data transmission device provided in an embodiment of the present application;

[0079] Figure 8 A schematic diagram of the structure of another data transmission device provided in an embodiment of the present application;

[0080] Fig. 9 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0081] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0082] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0083] With the popularization of the Internet, the data flow interaction between various network devices and mobile devices is increasing, and network security issues are gradually being taken seriously by major network companies. In a complete data interaction process, the security and reliability of applications that carry data transmission, reception, processing and other operations are extremely important.

[0084] In traditional end-to-end interactions, digital certificate management systems need to be deployed simultaneously to protect the security of data encryption keys, and the deployment workload is large. At the message sending end, the message data is encrypted by summary, concatenation and key encryption to obtain encrypted messages and encryption keys; the encrypted messages and encryption keys are sent to the message receiving end; at the message receiving end, the received encrypted messages and encryption keys are decrypted respectively, and the messages are verified according to the decryption results; in this process, a multi-layer verification mechanism is required, which is to replace the digital certificate with an asymmetric key. The security of the asymmetric key itself is difficult to guarantee. Although the use of asymmetric keys to protect encryption keys can reduce the engineering of deploying digital certificate management systems, it also loses the verification of the security and reliability of the asymmetric key itself. When the asymmetric key cannot guarantee security, the encryption key cannot be guaranteed to be leaked. How to improve the security of data transmission is an urgent problem to be solved.

[0085] In view of this, some embodiments of the present application provide a data transmission method, which includes obtaining timestamp information and data to be encrypted for transmission; determining a first dynamic derived key according to the HKDF key derivation algorithm, the timestamp information and the first identifier of the sending device; encrypting the data to be encrypted for transmission according to the first dynamic derived key to obtain target encrypted data; sending the target encrypted data, timestamp information and the first identifier of the sending device to the receiving device. The embodiments of the present application use a dynamic encryption scheme based on the HKDF key derivation algorithm to protect end-to-end authentication, transmission and storage data encryption, simplify the deployment engineering workload, and ensure the security of data transmission and storage.

[0086] like Figure 1 As shown, an embodiment of the present application provides a data transmission method, which is applied to a sending end device, and the method includes:

[0087] S101, obtaining timestamp information and data to be encrypted for transmission;

[0088] Specifically, when a sending device and a receiving device perform data transmission, the sending device needs to encrypt the data to be transmitted and send it to the receiving device, and the receiving device then decrypts the received encrypted data, thereby improving the security of data transmission. Based on this, in an embodiment of the present application, the sending device obtains the timestamp time and the data to be encrypted for transmission.

[0089] S102, determining a first dynamically derived key according to the HKDF key derivation algorithm, according to the timestamp information and the first identifier of the sending end device;

[0090] Specifically, the sending end device uses the HKDF key derivation algorithm to derive a first dynamic derived key from the timestamp information and the first identifier of the sending end device.

[0091] Among them, HKDF (HMAC-based Key Derivation Function) is a key derivation function based on HMAC.

[0092] S103, encrypting the data to be encrypted for transmission according to the first dynamically derived key to obtain target encrypted data;

[0093] The sending end device uses the first dynamically derived key to encrypt the data to be encrypted and transmit, and obtains target encrypted data, that is, ciphertext data.

[0094] S104: Send the target encrypted data, timestamp information, and a first identifier of the sending device to the receiving device.

[0095] The sending device sends the obtained target encrypted data, timestamp information and the sending device to the receiving device, and the receiving device decrypts the received target encrypted data to obtain the original data.

[0096] Some embodiments of the present application adopt the HKDF key derivation algorithm in combination with a timestamp to dynamically generate encryption keys during data transmission, thereby achieving dynamic encryption and ensuring the security of end-to-end data interaction. A dynamic encryption scheme based on the HKDF key derivation algorithm is used to protect end-to-end authentication, transmission, and storage data encryption, thereby simplifying the deployment workload while ensuring data transmission and storage security.

[0097] Another embodiment of the present application further supplements the data transmission method provided in the above embodiment.

[0098] Optionally, the first dynamically derived key is obtained by:

[0099] Determine a first derived key based on the HKDF key derivation algorithm and according to the first identifier of the sending end device;

[0100] Using a preset encryption and decryption algorithm, decrypting the pre-authenticated port command ciphertext according to the first derived key to obtain the password data;

[0101] Based on the HKDF key derivation algorithm, a first dynamically derived key is determined according to the timestamp information, the password data and the first identifier of the sending device.

[0102] Some embodiments of the present application use a symmetric encryption algorithm, and utilize SM4 keys and SM4ECB algorithms to encrypt and store local data, thereby improving the security of local data storage.

[0103] Optionally, the method further comprises:

[0104] Generate a first identifier of the sending end device according to the password data;

[0105] Based on the HKDF key derivation algorithm, generating a first derived key according to the first identifier of the sending end device;

[0106] Using a preset encryption and decryption algorithm, encrypt the password data according to the first derived key to obtain the port command ciphertext;

[0107] The port command ciphertext and the first identifier of the sending end device are stored.

[0108] Some embodiments of the present application complete the dynamic derivation of end-to-end data encryption keys based on the HKDF key derivation algorithm to ensure end-to-end data security.

[0109] Optionally, the preset encryption and decryption algorithm includes at least the SM4ECB algorithm.

[0110] Some embodiments of the present application use the HKDF key derivation algorithm, combined with a timestamp, to dynamically generate encryption keys during data transmission, implement dynamic encryption, and ensure the security of end-to-end data interaction.

[0111] In the embodiment of the present application, it is necessary to perform initialization on the sending end device and to perform registration on the receiving end device.

[0112] like Figure 3 As shown, it is a schematic diagram of the process of initializing the sending end device, including:

[0113] a1) During local SDK initialization, only the port command P needs to be set and a unique port ID allocation is generated;

[0114] SDK initialization information is encrypted and stored, which simplifies the deployment process while ensuring security and data confidentiality.

[0115] The port order P is used as an authentication factor of the terminal. It is necessary to ensure the confidentiality of storage while ensuring the authentication. The present invention calculates the hash value p of the port order through the SM3 hash algorithm, and authenticates the port order P by verifying the hash value.

[0116] a2) Derive the SM4 key KeyTmp based on HKDF(V,ID), where V is a fixed adjustment value built into the SDK;

[0117] a3) Encrypting the hash value p using the temporary key KeyTmp based on the SM4_ECB algorithm to obtain the ciphertext data DataP;

[0118] a4) The confidentiality of storage is ensured by storing the ciphertext DataP; the temporary key KeyTmp is derived based on the HKDF key derivation algorithm, with the password P and the unique terminal ID as parameters, and is only temporarily generated when it is necessary to encrypt and store p or decrypt the DataP authentication port command P, and is destroyed after the encryption and decryption is completed, and is not stored; the terminal that completes the SDK local initialization is in accordance with the present invention to complete the SDK local deployment work;

[0119] like Figure 5 As shown, it is a schematic diagram of the process of data transmission by the sending end device, including:

[0120] Step 51, according to the sender ID, derive the SM4 key KeyTmp based on HKDF(V, ID);

[0121] Step 52: Based on SM4ECB decryption, use KeyTmp to decrypt the ciphertext DataP to obtain the password P;

[0122] Step 53: Get the timestamp T, and derive the dynamic SM4 key Key based on HKDF(V, P, ID, T);

[0123] Step 54: Based on the SM4ECB algorithm, the data to be transmitted d is encrypted using Key to obtain the ciphertext D;

[0124] Step 55: Send D, timestamp T and unique end ID to the receiving device.

[0125] like Figure 2 As shown, some embodiments of the present application provide a data transmission method, which is applied to a receiving device, including:

[0126] S201, receiving target encrypted data, timestamp information and a first identifier of the sending end device sent by a sending end device;

[0127] S202, obtaining a second identifier of the receiving end device and a port command ciphertext, where the port command message is obtained through registration of the sending end device and the receiving end device;

[0128] S203, based on the HKDF key derivation algorithm, generate a second derived key according to the second identifier of the receiving end device;

[0129] S204, based on a preset encryption and decryption algorithm, decrypt the port command ciphertext according to the second derived key to obtain the password data;

[0130] S205, based on the HKDF key derivation algorithm, generate a second dynamic derived key according to the password data, the second identifier of the receiving end device and the timestamp information;

[0131] S206. Decrypt the target encrypted data according to the second dynamically derived key and the preset encryption and decryption algorithm to obtain the data to be encrypted for transmission.

[0132] Some embodiments of the present application use a dynamic encryption scheme based on the HKDF key derivation algorithm to protect end-to-end authentication, transmission and storage data encryption, simplify the deployment workload, and ensure the security of data transmission and storage.

[0133] Optionally, the method further comprises:

[0134] It is determined that the second identifier of the receiving device has been registered.

[0135] Optionally, the method further comprises:

[0136] Registration is performed on the receiving device according to the first identification and password data of the sending device.

[0137] like Figure 4 The following is a schematic diagram of the authentication process of the receiving device, which specifically includes:

[0138] Step b1) determines whether the local SDK initialization of the sending end device is completed. If it is completed, execute step b2); if not, prompt that the local SDK initialization needs to be performed first;

[0139] Step b2) Input peer ID2 and password P2;

[0140] Step b3) obtaining the identification ID of the receiving device;

[0141] Step b4) derive the SM4 key KerTmp based on HKDF(V, ID), where V is a fixed adjustment value built into the SDK;

[0142] Step b5) Based on the SM4ECB algorithm, use KeyTmp to encrypt P2 to obtain DataP2;

[0143] Step b6) The receiving device locally saves ID2 and DataP2.

[0144] like Figure 6 FIG. 1 is a schematic diagram of a data transmission process of a receiving device, including:

[0145] Step 61, the receiving device receives the ciphertext data D, the timestamp T and the sending end ID;

[0146] Step 62, determine whether the ID of the receiving device is registered, if so, execute step 63; if not, prompt that registration is required first;

[0147] Step 63, obtain the local ID2, and send the port command ciphertext DataP;

[0148] Step 64: According to ID2, derive the SM4 key KeyTmp2 based on HKDF(V,1D2);

[0149] Step 65: Based on SM4ECB, use KeyTmp2 to decrypt DataP and obtain the sending port command p;

[0150] Step 66: Derive the dynamic SM4 key Key based on HKDF(V, p, ID, T), and use Key to decrypt D based on SM4ECB to obtain the original text d.

[0151] Some embodiments of the present application have strong security because encryption keys are dynamically generated based on the HKDF key derivation algorithm according to timestamps during transmission, thereby achieving dynamic data encryption and ensuring data security and key security.

[0152] In the embodiment of the present application, the SDK is deployed locally, and the initialization password P is input through the initialization interface provided by the SDK to perform the initialization operation. The specific initialization steps are as follows:

[0153] After completing the SDK initialization process, as the sender, you need to obtain the timestamp data of this operation before sending data, and encrypt the data to be sent. For specific encryption and sending steps, please refer to Figure 5 After completing the SDK initialization process, as the receiving end, you need to complete the peer registration process. After completing the peer registration, the receiving end can decrypt and authenticate the peer data normally. For the specific peer registration process, please refer to Figure 4 ; After completing SDK initialization and peer registration, the receiving end decrypts the data sent by the peer according to the received ciphertext data and the peer ID. For specific steps, please refer to Figure 6 The receiving end processing flow.

[0154] The security of the embodiment of the present application is strong. During the transmission process, the encryption key is dynamically generated based on the HKDF key derivation algorithm according to the timestamp, and the dynamic encryption of data is realized, which ensures the security of data and key. The deployment difficulty is low. Compared with the traditional end-to-end interactive authentication, there is no need to deploy a certificate management system, only the SDK needs to be deployed, and the deployment is faster. The dynamic encryption scheme of the HKDF key derivation algorithm is adopted to dynamically encrypt and decrypt data. The complete encryption key information interaction is not involved in the data interaction process, ensuring security. In terms of engineering volume, the deployment of the digital certificate system is reduced, and the deployment difficulty is low. In terms of reliability, the complete key plaintext and ciphertext information will not be transmitted during the transmission interaction, and the key can be dynamically derived to achieve dynamic encryption and decryption. In summary, the embodiment of the present application has huge advantages, is easy to deploy, expand and maintain, and has greatly enhanced security. It should be noted that each implementable method in the present embodiment can be implemented separately, or it can be implemented in any combination without conflict. This application is not limited.

[0155] Another embodiment of the present application provides a data transmission device for executing the data transmission method provided in the above embodiment.

[0156] like Figure 7 , which is a schematic diagram of the structure of a data transmission device provided in an embodiment of the present application, and is applied to a sending end device. The data transmission device includes an acquisition module 701, a determination module 702, an encryption module 703 and a sending module 704, wherein:

[0157] The acquisition module 701 is used to acquire timestamp information and data to be encrypted for transmission;

[0158] The determination module 702 is used to determine a first dynamically derived key according to the HKDF key derivation algorithm, according to the timestamp information and the first identifier of the sending end device;

[0159] The encryption module 703 is used to encrypt the data to be encrypted according to the first dynamically derived key to obtain target encrypted data;

[0160] The sending module 704 is used to send the target encrypted data, timestamp information and the first identification of the sending device to the receiving device.

[0161] Regarding the device in this embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0162] Some embodiments of the present application adopt the HKDF key derivation algorithm in combination with a timestamp to dynamically generate encryption keys during data transmission, thereby achieving dynamic encryption and ensuring the security of end-to-end data interaction. A dynamic encryption scheme based on the HKDF key derivation algorithm is used to protect end-to-end authentication, transmission, and storage data encryption, thereby simplifying the deployment workload while ensuring data transmission and storage security.

[0163] Another embodiment of the present application further supplements the data transmission device provided in the above embodiment.

[0164] Optionally, the first dynamically derived key is obtained by:

[0165] Determine a first derived key based on the HKDF key derivation algorithm and according to the first identifier of the sending end device;

[0166] Using a preset encryption and decryption algorithm, decrypting the pre-authenticated port command ciphertext according to the first derived key to obtain the password data;

[0167] Based on the HKDF key derivation algorithm, a first dynamically derived key is determined according to the timestamp information, the password data and the first identifier of the sending device.

[0168] Some embodiments of the present application use a symmetric encryption algorithm, and utilize SM4 keys and SM4ECB algorithms to encrypt and store local data, thereby improving the security of local data storage.

[0169] Optionally, the acquisition module is used to:

[0170] Generate a first identifier of the sending end device according to the password data;

[0171] Based on the HKDF key derivation algorithm, generating a first derived key according to the first identifier of the sending end device;

[0172] Using a preset encryption and decryption algorithm, encrypt the password data according to the first derived key to obtain the port command ciphertext;

[0173] The port command ciphertext and the first identifier of the sending end device are stored.

[0174] Some embodiments of the present application complete the dynamic derivation of end-to-end data encryption keys based on the HKDF key derivation algorithm to ensure end-to-end data security.

[0175] Optionally, the preset encryption and decryption algorithm includes at least the SM4ECB algorithm.

[0176] Some embodiments of the present application use the HKDF key derivation algorithm, combined with a timestamp, to dynamically generate encryption keys during data transmission, implement dynamic encryption, and ensure the security of end-to-end data interaction.

[0177] like Figure 8 , which is a schematic diagram of the structure of a data transmission device provided in an embodiment of the present application, and is applied to a sending end device. The data transmission device includes a receiving module 801, a processing module 802, a derivation module 803, a decryption module 804, a generation module 805 and a recovery module 806, wherein:

[0178] The receiving module 801 is used to receive the target encrypted data, timestamp information and the first identifier of the sending end device sent by the sending end device;

[0179] The processing module 802 is used to obtain the second identifier of the receiving end device and the port command ciphertext, and the port command message is obtained through the registration of the sending end device and the receiving end device;

[0180] The derivation module 803 is used to generate a second derived key based on the HKDF key derivation algorithm and according to the second identifier of the receiving end device;

[0181] The decryption module 804 is used to decrypt the port command ciphertext according to the second derived key based on the preset encryption and decryption algorithm to obtain the password data;

[0182] The generating module 805 is used to generate a second dynamic derived key based on the HKDF key derivation algorithm according to the password data, the second identification of the receiving end device and the timestamp information;

[0183] The recovery module 806 is used to decrypt the target encrypted data according to the second dynamically derived key and the preset encryption and decryption algorithm to obtain the data to be encrypted for transmission.

[0184] Some embodiments of the present application use a dynamic encryption scheme based on the HKDF key derivation algorithm to protect end-to-end authentication, transmission and storage data encryption, simplify the deployment workload, and ensure the security of data transmission and storage.

[0185] Optionally, a recovery module is used to:

[0186] It is determined that the second identifier of the receiving device has been registered.

[0187] Optionally, the device further comprises a registration module, the registration module being configured to:

[0188] Registration is performed on the receiving device according to the first identification and password data of the sending device.

[0189] Some embodiments of the present application have strong security, because the encryption key is dynamically generated based on the HKDF key derivation algorithm according to the timestamp during the transmission process, and the data is dynamically encrypted, ensuring the security of data and keys. Regarding the device in this embodiment, the specific way in which each module performs the operation has been described in detail in the embodiment of the method, and will not be elaborated here.

[0190] It should be noted that each implementable method in this embodiment may be implemented separately, or may be implemented in combination in any manner without conflict, and this application is not limited thereto.

[0191] The embodiments of the present application also provide a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the operation of the method corresponding to any embodiment of the data transmission method provided in the above embodiments can be implemented.

[0192] An embodiment of the present application further provides a computer program product, wherein the computer program product includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations of the method corresponding to any embodiment of the data transmission method provided in the above embodiments.

[0193] like Fig. 9 As shown, some embodiments of the present application provide an electronic device 900, which includes: a memory 910, a processor 920, and a computer program stored in the memory 910 and executable on the processor 920, wherein the processor 920 can implement a method of any embodiment included in the above-mentioned data transmission method when reading the program from the memory 910 through a bus 930 and executing the program.

[0194] Processor 920 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 920 can be a microprocessor.

[0195] The memory 910 may be used to store instructions executed by the processor 920 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 920 of the disclosed embodiment may be used to execute instructions in the memory 910 to implement the method shown above. The memory 910 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0196] The above are only embodiments of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0197] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0198] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A data transmission method, characterized in that: Applied to a transmitting device, the method comprises: Obtain timestamp information and data to be encrypted for transmission; Determine a first dynamically derived key according to the HKDF key derivation algorithm and the timestamp information and the first identifier of the sending end device; Encrypting the to-be-encrypted transmission data according to the first dynamically derived key to obtain target encrypted data; The target encrypted data, the timestamp information and the first identifier of the sending device are sent to the receiving device.

2. The data transmission method according to claim 1, characterized in that: The first dynamically derived key is obtained in the following manner: Determine a first derived key based on the HKDF key derivation algorithm and according to the first identifier of the sending end device; Using a preset encryption and decryption algorithm, decrypting the pre-authenticated port command ciphertext according to the first derived key to obtain password data; Based on the HKDF key derivation algorithm, a first dynamically derived key is determined according to the timestamp information, the password data and the first identifier of the sending device.

3. The data transmission method according to claim 1, characterized in that: The method further comprises: Generate a first identification of the sending end device according to the password data; Based on the HKDF key derivation algorithm, generating a first derived key according to the first identifier of the sending end device; Using a preset encryption and decryption algorithm, encrypting the password data according to the first derived key to obtain the port command ciphertext; The port command ciphertext and the first identifier of the sending end device are stored.

4. The data transmission method according to claim 2, characterized in that: The preset encryption and decryption algorithm includes at least the SM4ECB algorithm.

5. A data transmission method, characterized in that: Applied to a receiving device, the method comprises: Receiving target encrypted data, timestamp information and a first identifier of the sending end device sent by the sending end device; Obtaining a second identifier of the receiving end device and a port command ciphertext, wherein the port command message is obtained through registration of the sending end device and the receiving end device; Based on the HKDF key derivation algorithm, generating a second derived key according to the second identifier of the receiving end device; Based on a preset encryption and decryption algorithm, decrypt the port command ciphertext according to the second derived key to obtain password data; Generate a second dynamic derived key based on the HKDF key derivation algorithm according to the password data, the second identifier of the receiving device and the timestamp information; The target encrypted data is decrypted according to the second dynamically derived key and the preset encryption and decryption algorithm to obtain the data to be encrypted for transmission.

6. The data transmission method according to claim 5, characterized in that: The method further comprises: It is determined that the second identifier of the receiving device has been registered.

7. The data transmission method according to claim 5, characterized in that: The method further comprises: Registering is performed on the receiving device according to the first identification and password data of the sending device.

8. An electronic device, characterized in that: It comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it can implement the data transmission method described in any one of claims 1-4 or 5-7.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the program, when executed by a processor, can implement the data transmission method described in any one of claims 1 to 4 or 5 to 7.

10. A computer program product, comprising a computer program, wherein: When the computer program is executed by a processor, it can implement the data transmission method described in any one of claims 1-4 or 5-7.

Images