Data processing system and method, communication equipment and storage medium

Abstract

The invention relates to the technical field of communication, and discloses a data processing system and method, a communication device and a storage medium, the system comprises a sending device, a transmission network and a receiving device; constructing a secure channel between the sending device and the receiving device in the transmission network based on a preset encryption protocol; the sending device generates a serial number corresponding to the data packet according to the FRER protocol, firstly adopts an encryption algorithm to encrypt the serial number to obtain a first-level encrypted data frame, and then adopts a preset encryption protocol to encrypt to obtain a second-level encrypted data frame; the receiving equipment is used for decrypting the received secondary encrypted data frame, verifying an integrity verification value obtained by decryption, and if verification succeeds, performing recovery processing on the secondary encrypted data frame to obtain a primary encrypted data frame; and determining the validity of the data packet according to the serial number and the valid verification code in the first-level encrypted data frame. The data packet is subjected to double encryption, so that the validity of the data packet is ensured.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a data processing system, method, communication device and storage medium. Background Art

[0002] With the deep integration of operational technology and information technology, Time-Sensitive Network (TSN) has emerged as an innovative technology. TSN can not only meet the strict requirements of industrial networks for real-time and determinism, but also enable different types of data flows, namely critical control data, ordinary IT traffic and time-sensitive data, to coexist harmoniously in the same network architecture.

[0003] In TSN, the core of the frame replication and elimination for reliability (FRER) mechanism defined by IEEE 802.1CB is to create multiple copies of each key data packet, transmit the same replicated data packets on different redundant paths, and eliminate duplicate data packets at the receiving end to improve the reliability of communication. The existing FRER mechanism has significant security vulnerabilities, which may be exploited by malicious attackers, thereby endangering the reliability and security of sensitive time networks. Summary of the invention

[0004] In view of this, the embodiments of the present application provide a data processing system, method, communication device and storage medium, which can effectively solve the problem of security vulnerabilities in the existing FRER mechanism affecting the security and reliability of sensitive time networks.

[0005] In a first aspect, an embodiment of the present application provides a data processing system, including a sending device, a transmission network, and a receiving device;

[0006] A secure channel based on a preset encryption protocol is constructed between the sending device and the receiving device in the transmission network;

[0007] The sending device is used to generate a serial number corresponding to a data packet according to the FRER protocol, and encrypt the serial number using an encryption algorithm to obtain a first-level encrypted data frame; and encrypt the first-level encrypted data frame using the preset encryption protocol to obtain a second-level encrypted data frame; the second-level encrypted data frame is transmitted via the secure channel;

[0008] The receiving device is used to decrypt the received secondary encrypted data frame and verify the integrity check value obtained by decryption. If the verification is successful, the secondary encrypted data frame is restored to obtain the primary encrypted data frame; and the validity of the data packet is determined based on the serial number and valid verification code in the primary encrypted data frame.

[0009] In some embodiments, the encryption algorithm is used to encrypt the serial number to obtain a first-level encrypted data frame, including:

[0010] The serial number is encrypted using an encryption algorithm to generate a complete verification code;

[0011] Intercepting the complete verification code to obtain the valid verification code;

[0012] The first-level encrypted data frame is determined according to the valid verification code and the data packet.

[0013] In some embodiments, determining the primary encrypted data frame according to the valid verification code and the data packet includes:

[0014] Inserting the valid verification into the tag field of the FRER protocol; the tag field also includes the serial number;

[0015] The first-level encrypted data frame is determined according to the tag field and the data packet.

[0016] In some embodiments, the step of encrypting the first-level encrypted data frame using the preset encryption protocol to obtain a second-level encrypted data frame includes:

[0017] Processing the primary encrypted data frame using the preset encryption protocol to generate a corresponding tag control field;

[0018] The encryption algorithm is used to encrypt the primary encrypted data to obtain an integrity check value;

[0019] The integrity check value, the tag control field and the primary encrypted data frame are encapsulated together into the secondary encrypted data frame.

[0020] In some embodiments, determining the validity of the data packet according to the sequence number and the valid verification code in the primary encrypted data frame includes:

[0021] Extracting the serial number and the valid verification code in the primary encrypted data frame;

[0022] The serial number is encrypted using the encryption algorithm to obtain a real-time verification code;

[0023] The validity of the sequence number of the data packet is determined according to the real-time verification code and the valid verification code.

[0024] In some embodiments, the step of encrypting the serial number using the encryption algorithm to obtain a real-time verification code includes:

[0025] The serial number is encrypted using an encryption algorithm to generate a new verification code;

[0026] Intercepting the new verification code to obtain the real-time verification code;

[0027] The method for intercepting the new verification code is the same as the method for intercepting the complete verification code.

[0028] In a second aspect, an embodiment of the present application provides a data processing method, which is applied to a sending device, and the method includes:

[0029] Processing the data packet according to the FRER protocol, generating a serial number corresponding to the data packet, and encrypting the serial number using an encryption algorithm to obtain a primary encrypted data frame; the serial number and the valid verification code in the primary encrypted data frame are used to verify whether the serial number of the data packet has been tampered with;

[0030] The first-level encrypted data frame is encrypted using a preset encryption protocol to obtain a second-level encrypted data frame; the integrity check value in the second-level encrypted data frame is used to verify whether the second-level encrypted data frame is complete.

[0031] In a third aspect, an embodiment of the present application provides a data processing method, applied to a receiving device, comprising:

[0032] Receive the secondary encrypted data frame, and verify the integrity check value obtained by decrypting the secondary encrypted data frame. If the verification is successful, restore the secondary encrypted data frame to obtain the primary encrypted data frame;

[0033] Determine whether the serial number of the data packet has been tampered with based on the serial number and the valid verification code in the first-level encrypted data frame.

[0034] In a fourth aspect, an embodiment of the present application provides a communication device, comprising a processor and a memory, wherein the memory stores a computer program, and the processor is used to execute the computer program to implement the above-mentioned data processing method.

[0035] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program, which implements the above-mentioned data processing method when executed on a processor.

[0036] The embodiments of the present application have the following beneficial effects:

[0037] The data processing system of the present application first builds a complete channel between the sending device and the receiving device for data transmission between the sending device and the receiving device. The sending device then performs double encryption processing on the data packet to be sent, and the receiving device performs double verification after receiving the double-encrypted secondary data frame to verify whether the serial number corresponding to the data packet has been tampered with, and further determine the validity of the corresponding data packet. The present application can ensure the reliability of data packet transmission in the network through double verification and double decryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 An application scenario diagram of a time-sensitive network based on the FRER mechanism in an embodiment of the present application is shown;

[0040] Figure 2 A system structure diagram of a data processing system in an embodiment of the present application is shown;

[0041] Figure 3 A flow chart of a data processing method in an embodiment of the present application is shown;

[0042] Figure 4 A flow chart of obtaining a primary encrypted data frame in an embodiment of the present application is shown;

[0043] Figure 5 A flow chart of obtaining a secondary encrypted data frame in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0044] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments.

[0045] The components of the embodiments of the present application generally described and shown in the drawings herein may be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0046] Hereinafter, the terms "including", "having" and their cognates that can be used in various embodiments of the present application are intended only to indicate specific features, numbers, steps, operations, elements, components or a combination of the foregoing items, and should not be understood as first excluding the existence of one or more other features, numbers, steps, operations, elements, components or a combination of the foregoing items or increasing the possibility of one or more features, numbers, steps, operations, elements, components or a combination of the foregoing items. In addition, the terms "first", "second", "third" and the like are only used to distinguish descriptions and cannot be understood as indicating or implying relative importance.

[0047] Unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meanings as those generally understood by those skilled in the art to which the various embodiments of the present application belong. The terms (such as those defined in generally used dictionaries) will be interpreted as having the same meanings as the contextual meanings in the relevant technical field and will not be interpreted as having idealized meanings or overly formal meanings unless clearly defined in the various embodiments of the present application.

[0048] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0049] like Figure 1 As shown in the figure, the time-sensitive network based on the FRER mechanism is a transmission network. The FRER mechanism lacks the validity verification of the sequence number, and directly regards the subsequent arriving data frames with the same sequence number as duplicates and deletes them; therefore, attackers can easily deceive the system by forging malicious data packets with false sequence numbers, causing legitimate data packets to be mistakenly discarded. This vulnerability not only seriously threatens the basic functions of FRER, but also may cause the loss of critical data and a significant degradation of system performance. More seriously, attackers may use this vulnerability to carry out more complex attacks, such as manipulating network traffic through carefully designed sequence numbers, or exhausting network resources by continuously injecting false data packets. In addition, since the FRER mechanism is widely used in sensitive time networks, this vulnerability may cause a chain reaction in the TSN ecosystem, affecting key applications and services that rely on high-reliability communications. Therefore, solving the security vulnerabilities in the FRER mechanism is not only related to the security of a single time-sensitive network, but also to the stability and reliability of the entire industrial and critical infrastructure fields. Therefore, it is necessary to develop more powerful verification and protection mechanisms to resist potential attacks.

[0050] The data processing system is described below in conjunction with some specific embodiments.

[0051] Figure 2A system structure diagram of a data processing system according to an embodiment of the present application is shown. Exemplarily, the data processing system includes a sending device, a time-sensitive network and a receiving device, and a data packet sent by the sending device is transmitted to the receiving device via the time-sensitive network.

[0052] A preset encryption protocol is used to establish a secure channel between the sending device and the receiving device. A preset encryption protocol is used to establish a secure channel between the sending device and the receiving device at the data link layer to ensure confidentiality and integrity between the sending device and the receiving device.

[0053] In this embodiment, the preset encryption protocol is the MACsec protocol; MACsec stands for Media Access Control Security, which is mainly used for data encryption, and also has authentication and verification functions; the data it protects is data above the second layer in Ethernet, that is, data including ARP, which will be encrypted and cannot be obtained through network monitoring. At the same time, compared with other encryption methods, such as TLS, MACsec can achieve lower latency and higher performance because it can be implemented based on hardware; and for upper-layer applications, MACsec encrypts at the second layer, so it is imperceptible to the upper layer, which means that the upper layer does not need to make any changes to deploy encryption. This has great advantages for the current non-encrypted system to switch to an encrypted system.

[0054] The process of establishing a secure channel at the data link layer can also be understood as a handshake process between the sending device and the receiving device. The handshake phase includes the following stages:

[0055] During the connection establishment phase, the sending device and the receiving device in the time-sensitive network need to first establish a secure connection through the MKA protocol and exchange their respective secure channel identifiers (SCI); this is the basis for establishing secure communication.

[0056] During the key negotiation phase, the sending device pre-configures a security association key (SAK) based on the MACsec protocol, encrypts the security association key using the connectivity association key (CAK) pre-shared between the sending device and the receiving device, and securely distributes the encrypted security association key SAK to the receiving device.

[0057] During the security parameter exchange phase, the sending device and the receiving device exchange security association parameters (SA), determine the encryption algorithm and other security attributes used to encrypt the serial number, and negotiate a short-term session key; the encryption algorithm is, for example, the AES-GCM (Galois / Counter Mode) algorithm; other security attributes include Ethernet type, etc.

[0058] During the verification and confirmation phase, both the sending device and the receiving device will verify the received security association parameters and confirm the validity of the key material to finally complete the MKA protocol handshake.

[0059] In the channel encryption phase, after a secure channel is established, the sending device and the receiving device use the negotiated security association key SAK to establish an encrypted channel in the time-sensitive network, encrypt the FRER sequence number for data transmission, and maintain the security of communication by regularly updating the security association key.

[0060] In this embodiment, the sending device is used to generate a serial number corresponding to a data packet according to the FRER protocol; the serial number is encrypted using the AES-GCM algorithm to generate a complete verification code; for example, the byte length of the complete verification code is 32 bits; the preset length of the complete verification code (for example, the first 16 bits) is then intercepted to obtain a valid verification code; for example, the byte length of the valid verification code is 16 bits, which can be the first 16 bits or the last 16 bits of the complete verification code; the valid verification is inserted into the label field of the FRER protocol; the label field of the FRER protocol is actually an R-TAG tag; finally, a first-level encrypted data frame is determined based on the label field and the data packet.

[0061] In this embodiment, the calculation method of the complete verification code is:

[0062] Y=AES_GCM_Encrypt(SAK,SequenceNum)

[0063] Wherein, Y represents the complete verification code, AES_GCM_Encrypt represents the encryption function using the AES_GCM algorithm, SAK represents the security association key, and SequenceNum represents the sequence number of the data packet.

[0064] In this embodiment, the R-TAG is marked as follows:

[0065] Ethernet Type Valid verification code Serial Number 2Byte 2Byte 2Byte

[0066] In this embodiment, the frame structure of the first-level encrypted data frame includes the destination address DMAC, the source address DMAC, the type / length, the tag field R-TAG of the FRER protocol, the data packet Payload and the frame check FCS; as follows:

[0067] DMAC SMAC Type / Length R-TAG Payload FCS

[0068] After encryption through the AES_GCM algorithm and insertion of the valid verification code into the R-TAG tag, the R-TAG tag includes both the original serial number and the encrypted information used for verification, namely the valid verification code, which can effectively prevent man-in-the-middle attacks.

[0069] In order to further improve the security and reliability of the serial number, the first-level encrypted data frame is encrypted based on a preset encryption protocol to obtain a second-level encrypted data frame, and the second-level encrypted data frame is sent.

[0070] In this embodiment, the preset encryption protocol is the MACsec encryption mechanism, and the MACsec protocol is used to encrypt the first-level encrypted data frame to generate the tag control field of the MACsec protocol, namely the SecTAG tag. The SecTAG tag includes control information such as tag control information TCI, association number AN, and packet number PN; tag control information TCI (Tag Control Information) is used to indicate the version and length of SecTAG; association number AN (Association Number) is used to identify the security association used; SL (Short Length): if it is a short-format SecTAG, this field is included; packet number PN (Packet Number): data packet sequence number, used to prevent replay attacks; secure channel identifier SCI (Secure Channel Identifier) ​​is used to include this field when using the long-format SecTAG, and is used to identify the secure channel. Based on the security association key SAK, the AES_GCM algorithm is used to encrypt the first-level encrypted data frame to obtain the integrity check value ICV; the integrity check value ICV, the SecTAG tag and the first-level encrypted data frame are encapsulated into a second-level encrypted data frame.

[0071] In this embodiment, the frame structure of the secondary encrypted data frame is as follows:

[0072] DMAC SMAC SecTAG R-TAG Payload ICV FCS

[0073] The negotiated security association key SAK is used, and the AES_GCM algorithm is used to encrypt the first-level encrypted data frame (including the data packet and part of the MAC header field), that is, the SecTAG tag is updated to the MACsec type, that is, the type / length, and the integrity check value ICV is generated and inserted into the first-level encrypted data frame to form a second-level encrypted data frame; a new frame check is also calculated in the process to correspond to the second-level encrypted data frame of the MACsec protocol. The label field R-TAG and the data packet of the FRER protocol are encrypted by the AES_GCM algorithm, and the calculated integrity check value ICV covers the content of the entire second-level encrypted data frame, realizing the confidentiality, integrity protection and anti-replay protection of the corresponding sequence number based on the FRER protocol.

[0074] In this embodiment, the receiving device first identifies that the received secondary encrypted data frame is a MACsec frame through the Ethernet type field, and then parses the secondary encrypted data frame, extracts information such as TCI, AN, PN, etc., determines the security association used according to the security channel identifier SCI and the association number AN, and checks the packet sequence number PN to prevent replay attacks. Then, the secondary encrypted data frame is decrypted using the corresponding security association key SAK to obtain an integrity check value; and the integrity check value obtained by parsing is verified. If the verification is successful, the secondary encrypted data frame is restored, that is, the tag control field SecTAG and the integrity check value ICV are removed from the secondary encrypted data frame to restore the primary encrypted data frame. Finally, the serial number and valid verification code in R-TAG are extracted from the primary encrypted data frame; and the extracted serial number is encrypted by AES-GCM using the same security association key SAK and encryption algorithm to generate a new verification code, and 16 bits are intercepted from the new verification code to obtain a real-time verification code; wherein, the interception method of the new verification code is the same as the interception method of the complete verification code.

[0075] In this embodiment, the receiving device compares the real-time verification code with the valid verification code in the tag field R-TAG: if the real-time verification code is consistent with the valid verification code, it means that the serial number of the data packet has not been tampered with, and the corresponding data packet is valid. At this time, the decrypted data packet is delivered to the FRER protocol for subsequent processing; if the real-time verification code is inconsistent with the valid verification code, it means that the serial number has been tampered with, the corresponding data packet is invalid, the system will discard the data packet, and record the security event. This process ensures the integrity of the serial number, prevents man-in-the-middle attacks and serial number tampering. When continuous integrity check value ICV verification failures are detected, the security alarm mechanism will also be triggered to promptly notify the network administrator to take necessary protective measures.

[0076] The FRER serial number verification method of the receiving device effectively improves the security of the FRER protocol by adding cryptographic protection at the end-to-end level, while maintaining compatibility with the existing TSN network. It provides a powerful security enhancement method for time-sensitive networks, and is particularly suitable for applications in industrial control, vehicle networks, avionics and other fields that require high reliability and security, providing a balanced, efficient and scalable security enhancement solution for TSN networks.

[0077] Figure 3 A flow chart of a data processing method according to an embodiment of the present application is shown. Exemplarily, the data processing method includes the following steps:

[0078] S100, building a secure channel between the sending device and the receiving device based on a preset encryption protocol.

[0079] In this embodiment, the secure channel uses a preset encryption protocol, for example, the preset encryption protocol is a MACsec protocol. Using the MACsec protocol on the secure channel between the sending device and the receiving device can ensure the confidentiality and integrity of the communication at both ends of the secure channel.

[0080] S200, processing the data packet according to the FRER protocol, generating a serial number corresponding to the data packet, and encrypting the serial number using an encryption algorithm to obtain a first-level encrypted data frame.

[0081] In this embodiment, if Figure 4 As shown, the process of encrypting the serial number using an encryption algorithm to obtain a first-level encrypted data frame includes:

[0082] S210, encrypt the serial number using an encryption algorithm to generate a complete verification code.

[0083] In this embodiment, the AES-GCM algorithm is used to encrypt the serial number to generate a complete verification code; for example, the byte length of the complete verification code is 32 bits.

[0084] S220, intercepting the complete verification code to obtain a valid verification code.

[0085] In this embodiment, a preset length (eg, the first 16 bits) of the complete verification code is truncated to obtain a valid verification code; for example, the byte length of the valid verification code is 16 bits, which may be the first 16 bits or the last 16 bits of the complete verification code.

[0086] S230, determining a primary encrypted data frame according to the valid verification code and the data packet.

[0087] In this embodiment, the valid verification is inserted into the tag field R-TAG tag of the FRER protocol; the tag field R-TAG tag also includes a serial number; and the first-level encrypted data frame is determined according to the tag field R-TAG tag and the data packet.

[0088] A MACsec-based sequence number verification mechanism is introduced on the basis of the FRER protocol. By embedding the 16-bit verification code into the tag field R-TAG of FRER, security enhancement is achieved without changing the existing frame structure.

[0089] S300, encrypting the first-level encrypted data frame using a preset encryption protocol to obtain a second-level encrypted data frame.

[0090] In this embodiment, Figure 5 As shown, the process of encrypting the primary encrypted data frame using the encryption algorithm to obtain the secondary encrypted data frame includes:

[0091] S310, using a preset encryption protocol to process the first-level encrypted data frame to generate a corresponding tag control field.

[0092] In this embodiment, the MACsec protocol is used to encrypt the first-level encrypted data frame to generate the tag control field of the MACsec protocol, namely the SecTAG tag. The SecTAG tag includes control information such as tag control information TCI, association number AN, and packet number PN. The tag control information TCI (Tag Control Information) is used to indicate the version and length of SecTAG; the association number AN (Association Number) is used to identify the security association used; SL (Short Length): if it is a short format SecTAG, this field is included; packet number PN (Packet Number): data packet sequence number, used to prevent replay attacks; secure channel identifier SCI (Secure Channel Identifier) ​​is used to include this field when using the long format SecTAG, and is used to identify the secure channel.

[0093] S320, encrypt the primary encrypted data using an encryption algorithm to obtain an integrity check value.

[0094] In this embodiment, based on the security association key SAK, the AES_GCM algorithm is used to encrypt the first-level encrypted data frame to obtain the integrity check value ICV.

[0095] S330, encapsulate the integrity check value, the tag control field and the primary encrypted data frame into a secondary encrypted data frame.

[0096] In this embodiment, the integrity check value ICV, SecTAG tag and the first-level encrypted data frame are encapsulated into a second-level encrypted data frame. The frame structure of the second-level encrypted data frame updates the MACsec type, i.e., type / length, relative to the first-level encrypted data frame, and adds the integrity check value ICV.

[0097] The label field R-TAG and data packet of the FRER protocol are encrypted by the AES_GCM algorithm. At the same time, the calculated integrity check value ICV covers the content of the entire secondary encrypted data frame, realizing the confidentiality, integrity protection and anti-replay protection of the corresponding sequence number based on the FRER protocol.

[0098] S400, decrypt the received secondary encrypted data frame and verify the integrity check value obtained by decryption. If the check succeeds, restore the secondary encrypted data frame to obtain the primary encrypted data frame.

[0099] In this embodiment, the Ethernet type field is used to identify that the received secondary encrypted data frame is a MACsec frame, and then the secondary encrypted data frame is parsed to extract information such as TCI, AN, and PN. The security association used is determined based on the secure channel identifier SCI and the association number AN, and the packet sequence number PN is checked to prevent replay attacks. Then, the secondary encrypted data frame is decrypted using the corresponding security association key SAK to obtain an integrity check value; and the integrity check value obtained by parsing is verified. If the verification is successful, the tag control field SecTAG and the integrity check value ICV are removed from the secondary encrypted data frame to restore the primary encrypted data frame.

[0100] S500, determining the validity of the data packet according to the sequence number and the valid verification code in the primary encrypted data frame.

[0101] In this embodiment, the serial number and valid verification code in the first-level encrypted data frame are first extracted; the same security association key SAK is used to encrypt the serial number using the AES_GCM algorithm to generate a new verification code. Then, the 16-bit bit of the new verification is intercepted to obtain a real-time verification code; wherein, the interception method of the new verification code is the same as the interception method of the complete verification code. Finally, the validity of the serial number of the data packet is determined based on the real-time verification code and the valid verification code. If the real-time verification code is consistent with the valid verification code, it means that the serial number of the data packet has not been tampered with, and the corresponding data packet is valid. At this time, the decrypted data packet is delivered to the FRER protocol for subsequent processing; if the real-time verification code is inconsistent with the valid verification code, it means that the serial number has been tampered with, and the corresponding data packet is invalid. The system will discard the data packet and record the security event.

[0102] This dual verification method of the FRER serial number effectively improves the security of the FRER protocol by adding cryptographic protection at the end-to-end level, while maintaining compatibility with existing TSN networks. It provides a powerful security enhancement for time-sensitive networks, and is particularly suitable for applications in industrial control, vehicle networks, avionics, and other fields that require high reliability and security.

[0103] The present application also provides a communication device. Exemplarily, the communication device includes a processor and a memory, wherein the memory stores a computer program, and the processor runs the computer program to enable the communication device to execute the above-mentioned data processing method or the function of the sending device or the receiving device in the above-mentioned data processing system.

[0104] Among them, the processor can be an integrated circuit chip with signal processing capabilities. The processor can be a general-purpose processor, including a central processing unit (CPU), a graphics processing unit (GPU) and a network processor (NP), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or at least one of other programmable logic devices, discrete gates or transistor logic devices, and discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc., which can implement or execute the disclosed methods, steps and logic block diagrams in the embodiments of the present application.

[0105] The memory may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc. The memory is used to store a computer program, and the processor may execute the computer program accordingly after receiving an execution instruction.

[0106] The present application also provides a computer-readable storage medium for storing the computer program used in the above communication device. For example, the computer-readable storage medium may include, but is not limited to, various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0107] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and structure diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in an alternative implementation, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the structure diagram and / or the flow diagram, and the combination of boxes in the structure diagram and / or the flow diagram, can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0108] In addition, the functional modules or units in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0109] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a smart phone, a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application.

[0110] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A data processing system, characterized in that: Includes sending equipment, transmission network and receiving equipment; A secure channel based on a preset encryption protocol is constructed between the sending device and the receiving device in the transmission network; The sending device is used to generate a serial number corresponding to a data packet according to the FRER protocol, and encrypt the serial number using an encryption algorithm to obtain a first-level encrypted data frame; and encrypt the first-level encrypted data frame using the preset encryption protocol to obtain a second-level encrypted data frame; The secondary encrypted data frame is transmitted via the secure channel; The receiving device is used to decrypt the received secondary encrypted data frame and verify the integrity check value obtained by decryption. If the verification is successful, the secondary encrypted data frame is restored to obtain the primary encrypted data frame; and the validity of the data packet is determined based on the serial number and valid verification code in the primary encrypted data frame.

2. The data processing system according to claim 1, characterized in that The encryption algorithm is used to encrypt the serial number to obtain a first-level encrypted data frame, including: The serial number is encrypted using an encryption algorithm to generate a complete verification code; Intercepting the complete verification code to obtain the valid verification code; The first-level encrypted data frame is determined according to the valid verification code and the data packet.

3. The data processing system according to claim 2, characterized in that: The step of determining the first-level encrypted data frame according to the valid verification code and the data packet includes: Inserting the valid verification into the tag field of the FRER protocol; the tag field also includes the serial number; The first-level encrypted data frame is determined according to the tag field and the data packet.

4. The data processing system according to claim 1, characterized in that: The step of encrypting the first-level encrypted data frame using the preset encryption protocol to obtain a second-level encrypted data frame includes: Processing the primary encrypted data frame using the preset encryption protocol to generate a corresponding tag control field; The encryption algorithm is used to encrypt the primary encrypted data to obtain an integrity check value; The integrity check value, the tag control field and the first-level encrypted data frame are encapsulated together into the second-level encrypted data frame.

5. The data processing system according to claim 2, characterized in that: Determining the validity of the data packet according to the sequence number and the valid verification code in the primary encrypted data frame includes: Extracting the serial number and the valid verification code in the primary encrypted data frame; The serial number is encrypted using the encryption algorithm to obtain a real-time verification code; The validity of the sequence number of the data packet is determined according to the real-time verification code and the valid verification code.

6. The data processing system according to claim 5, characterized in that: The step of encrypting the serial number using the encryption algorithm to obtain a real-time verification code includes: The serial number is encrypted using an encryption algorithm to generate a new verification code; Intercepting the new verification code to obtain the real-time verification code; The method for intercepting the new verification code is the same as the method for intercepting the complete verification code.

7. A data processing method, characterized in that: Applied to a sending device, the method comprises: Processing the data packet according to the FRER protocol, generating a serial number corresponding to the data packet, and encrypting the serial number using an encryption algorithm to obtain a primary encrypted data frame; the serial number and the valid verification code in the primary encrypted data frame are used to verify whether the serial number of the data packet has been tampered with; The first-level encrypted data frame is encrypted using a preset encryption protocol to obtain a second-level encrypted data frame; the integrity check value in the second-level encrypted data frame is used to verify whether the second-level encrypted data frame is complete.

8. A data processing method, characterized in that: Applicable to receiving equipment, including: Receive the secondary encrypted data frame, and verify the integrity check value obtained by decrypting the secondary encrypted data frame. If the verification is successful, restore the secondary encrypted data frame to obtain the primary encrypted data frame; Determine whether the serial number of the data packet has been tampered with based on the serial number and the valid verification code in the first-level encrypted data frame.

9. A communication device, characterized in that: The communication device comprises a processor and a memory, wherein the memory stores a computer program, and the processor is configured to execute the computer program to implement the data processing method according to claim 7 or 8.

10. A computer-readable storage medium, characterized in that: The computer program stores a computer program, which, when executed on a processor, implements the data processing method according to claim 7 or 8.

Images