Encrypted data transmission method, device and system

Abstract

The invention discloses an encrypted data transmission method, device and system, and relates to the technical field of data security, and the main technical scheme comprises the following steps: obtaining a data request instruction sent by target user data management; wherein the data request instruction comprises target card data; obtaining the target card data from a card data database, and encrypting the target card data according to a preset key and an encryption algorithm; wherein the preset secret key is obtained through calculation according to at least three secret key components; and sending the encrypted target card data to the target user data management. Compared with the prior art, according to the embodiment of the invention, the preset key is calculated by adopting the plurality of key components, so that the complexity of an encryption algorithm is enhanced, the risk that the key is cracked is reduced, and the card data security protection capability is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of data security technology, and in particular to a method, device and system for transmitting encrypted data. Background Art

[0002] The business card (U)SIM (Universal Subscriber Identity Module) is divided into a physical card and a pre-installed blank card. The key data involved mainly includes five-digit data, card writing key and PIN (Personal Identification Number) code, etc. Once these data are leaked, it will make it possible to copy the SIM card, causing extremely serious consequences. Summary of the invention

[0003] The present disclosure provides a method, device and system for transmitting encrypted data.

[0004] According to a first aspect of the present disclosure, a method for transmitting encrypted data is provided, wherein the method is applied to a number card center, comprising:

[0005] Obtaining a data request instruction sent by a target user data management; wherein the data request instruction includes target card data;

[0006] Obtain the target card data in a card data database, and encrypt the target card data according to a preset secret key and an encryption algorithm; wherein the preset secret key is calculated based on at least three secret key components;

[0007] The encrypted target card data is sent to the target user data management.

[0008] Optionally, before obtaining the data request instruction sent by the target user data management, the method further includes:

[0009] Acquire card data and store the card data in the card data database; wherein the card data database uses a preset encryption algorithm to uniformly encrypt all card data;

[0010] The acquiring the target card data in the card data database further comprises:

[0011] The encrypted target card data is obtained, and decrypted based on the preset encryption algorithm to obtain the original data of the target card data.

[0012] Optionally, before encrypting the target card data according to a preset secret key and encryption algorithm, the method further includes:

[0013] Obtain the key components for each user's data management;

[0014] Generate a preset key corresponding to each user data management according to the key components of each user data management and a preset key generation algorithm;

[0015] The encrypting the card data according to the preset secret key and encryption algorithm also includes:

[0016] Obtain the target preset key corresponding to the target user data management;

[0017] The target card data is encrypted according to the target preset key and the encryption algorithm.

[0018] Optionally, generating a preset key corresponding to each user data management further includes:

[0019] Generate a first verification value for each preset key according to each of the key components of the user data management and a preset key generation algorithm;

[0020] Obtaining a second verification value of each preset secret key sent by each user data management;

[0021] When it is determined that the first verification value and the second verification value of each preset key are consistent, it is determined that the verification is successful.

[0022] According to a second aspect of the present disclosure, a method for transmitting encrypted data is provided, the method being applied to user data management, comprising:

[0023] Send data request instruction;

[0024] Obtain the encrypted target card data sent by the number card center;

[0025] Decrypting the target card data based on a preset secret key and encryption algorithm to obtain the original data of the target card data;

[0026] An authentication vector is calculated according to the original data of the target card data, and user security verification is performed according to the authentication vector.

[0027] Optionally, after obtaining the encrypted target card data sent by the number card center, the method further includes:

[0028] The card data is stored in the card data database; wherein the card data database uses a preset encryption algorithm to uniformly encrypt all card data.

[0029] Optionally, before decrypting the target card data based on a preset secret key and an encryption algorithm to obtain the original data of the target card data, the method further includes:

[0030] Generate a preset key and a second verification value of the preset key according to the key components and a preset key generation algorithm;

[0031] The second verification value is sent to the number card center.

[0032] According to a third aspect of the present disclosure, a device for transmitting encrypted data is provided, and the device is applied to a number card center, comprising:

[0033] A first acquisition unit, configured to acquire a data request instruction sent by a target user data management; wherein the data request instruction includes target card data;

[0034] An encryption unit, used for obtaining the target card data from a card data database, and encrypting the target card data according to a preset secret key and an encryption algorithm; wherein the preset secret key is calculated based on at least three secret key components;

[0035] The sending unit is used to send the encrypted target card data to the target user data management.

[0036] Optionally, before the first acquiring unit acquires the data request instruction sent by the target user data management, the device further includes:

[0037] A storage unit, used to obtain card data and store the card data in the card data database; wherein the card data database uses a preset encryption algorithm to uniformly encrypt all card data;

[0038] The encryption unit is also used for:

[0039] The encrypted target card data is obtained, and decrypted based on the preset encryption algorithm to obtain the original data of the target card data.

[0040] Optionally, the device further comprises:

[0041] A second acquisition unit, used for acquiring a key component for each user data management before the encryption unit encrypts the target card data according to a preset key and encryption algorithm;

[0042] A generating unit, configured to generate a preset secret key corresponding to each user data management according to the secret key components of each user data management and a preset secret key generation algorithm;

[0043] The encryption unit is also used for:

[0044] Obtain the target preset key corresponding to the target user data management;

[0045] The target card data is encrypted according to the target preset key and the encryption algorithm.

[0046] Optionally, the generating unit is further used for:

[0047] Generate a first verification value for each preset key according to each of the key components of the user data management and a preset key generation algorithm;

[0048] Obtaining a second verification value of each preset secret key sent by each user data management;

[0049] When it is determined that the first verification value and the second verification value of each preset key are consistent, it is determined that the verification is successful.

[0050] According to a fourth aspect of the present disclosure, there is provided a device for transmitting encrypted data, the device being applied to user data management, comprising:

[0051] A sending unit, used for sending a data request instruction;

[0052] An acquisition unit, used for acquiring the encrypted target card data sent by the number card center;

[0053] A decryption unit, used to decrypt the target card data based on a preset secret key and an encryption algorithm to obtain the original data of the target card data;

[0054] The security verification unit is used to calculate an authentication vector according to the original data of the target card data, and perform user security verification according to the authentication vector.

[0055] Optionally, the device further comprises:

[0056] The storage unit is used to store the card data into the card data database after the acquisition unit acquires the encrypted target card data sent by the number card center; wherein the card data database uses a preset encryption algorithm to uniformly encrypt all card data.

[0057] Optionally, the device further comprises:

[0058] a generating unit, configured to generate a preset key and a second verification value of the preset key according to a key component and a preset key generating algorithm before the decryption unit decrypts the target card data based on the preset key and the encryption algorithm to obtain the original data of the target card data;

[0059] The sending unit is also used to send the second verification value to the number card center.

[0060] According to a fifth aspect of the present disclosure, a system for transmitting encrypted data is provided, the system comprising: a number card center and a user data management, wherein:

[0061] The number card center is used for:

[0062] Obtaining a data request instruction sent by a target user data management; wherein the data request instruction includes target card data;

[0063] Obtain the target card data in a card data database, and encrypt the target card data according to a preset secret key and an encryption algorithm; wherein the preset secret key is calculated based on at least three secret key components;

[0064] Sending the encrypted target card data to the target user data management;

[0065] The user data management is used to:

[0066] Send data request instruction;

[0067] Obtain the encrypted target card data sent by the number card center;

[0068] Decrypting the target card data based on a preset secret key and encryption algorithm to obtain the original data of the target card data;

[0069] An authentication vector is calculated according to the original data of the target card data, and user security verification is performed according to the authentication vector.

[0070] According to a third aspect of the present disclosure, there is provided an electronic device, including:

[0071] at least one processor; and

[0072] a memory communicatively connected to the at least one processor; wherein,

[0073] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the first aspect.

[0074] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described in the first aspect.

[0075] According to a fifth aspect of the present disclosure, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the method as described in the first aspect above.

[0076] The encrypted data transmission method, device and system provided by the present disclosure mainly include the following technical solutions: obtaining a data request instruction sent by a target user data management; wherein the data request instruction includes target card data; obtaining the target card data in a card data database, and encrypting the target card data according to a preset secret key and an encryption algorithm; wherein the preset secret key is calculated based on at least three secret key components; and sending the encrypted target card data to the target user data management. Compared with the related art, the embodiment of the present application increases the complexity of the encryption algorithm by using multiple secret key components to calculate the preset secret key, reduces the risk of the secret key being cracked, and improves the card data security protection capability.

[0077] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0079] Figure 1 A schematic diagram of a flow chart of a method for transmitting encrypted data provided by an embodiment of the present disclosure;

[0080] Figure 2 A schematic diagram of a process of transmitting encrypted data provided by an embodiment of the present disclosure;

[0081] Figure 3 A schematic diagram of a flow chart of a method for transmitting encrypted data provided by an embodiment of the present disclosure;

[0082] Figure 4 A schematic diagram of a flow chart of a method for transmitting encrypted data provided by an embodiment of the present disclosure;

[0083] Figure 5 A schematic diagram of a flow chart of a method for transmitting encrypted data provided by an embodiment of the present disclosure;

[0084] Figure 6 A schematic diagram of a 2G authentication process provided by an embodiment of the present disclosure;

[0085] Figure 7 A schematic diagram of a 4G authentication process provided by an embodiment of the present disclosure;

[0086] Figure 8 A schematic diagram of a 5G authentication process provided by an embodiment of the present disclosure;

[0087] Fig. 9 A schematic diagram of a flow chart of a method for transmitting encrypted data provided by an embodiment of the present disclosure;

[0088] Fig.10 A schematic diagram of the structure of a transmission device for encrypted data provided by an embodiment of the present disclosure;

[0089] Fig.11 A schematic diagram of the structure of a transmission device for encrypted data provided by an embodiment of the present disclosure;

[0090] Fig.12 A schematic diagram of the structure of a transmission device for encrypted data provided by an embodiment of the present disclosure;

[0091] Fig.13 A schematic diagram of the structure of a transmission device for encrypted data provided by an embodiment of the present disclosure;

[0092] Fig.14 A schematic block diagram of an exemplary electronic device provided for an embodiment of the present disclosure. DETAILED DESCRIPTION

[0093] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0094] The following describes the encrypted data transmission method, device and system according to the embodiments of the present disclosure with reference to the accompanying drawings.

[0095] Figure 1 A flowchart of a method for transmitting encrypted data provided by an embodiment of the present disclosure.

[0096] like Figure 1 As shown, the method is applied to a number card center, and the method comprises the following steps:

[0097] Step 101, obtaining a data request instruction sent by a target user data management; wherein the data request instruction includes target card data.

[0098] In some embodiments, when a user needs to activate a card, a data request is issued in the UDM (User Data Management), and the request is sent to the card center through the UDM. The data request instruction includes a request for specific target card data, which may include but is not limited to sensitive information such as card information and user identity verification.

[0099] The card data includes: five-digit data, card writing key and PIN (Personal Identification Number) code, etc. The five-digit data includes: Ki: authentication key, OPc: algorithm configuration variable, IMSI: International Mobile Subscriber Identity, ICCID: Integrated Circuit Card Identification Code, SMSP: Short Message Service Center.

[0100] Step 102, obtaining the target card data from the card data database, and encrypting the target card data according to a preset key and an encryption algorithm; wherein the preset key is calculated based on at least three key components.

[0101] In the number card center, after receiving the data request instruction sent by the target user data management module, the target card data is retrieved and obtained in the card data database according to the data request information. After the target card data is extracted, it is encrypted using a preset encryption algorithm. The preset secret key here is obtained by calculating at least three secret key components. This multi-factor secret key generation strategy greatly enhances the security of encryption.

[0102] In this way, the target card data is highly encrypted before leaving the database, ensuring the security of the data during transmission. This encryption mechanism effectively protects the transmission security of card data and prevents the risk of data leakage and unauthorized access. At the same time, the use of composite key strategy also increases the complexity of encryption, making it more difficult to crack, thereby further improving the level of data protection and ensuring user privacy and data security.

[0103] Step 103: Send the encrypted target card data to the target user data management.

[0104] See also Figure 2 . Figure 2 A schematic diagram of a process of transmitting encrypted data provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, in some embodiments, the encrypted target card data can be encapsulated into a format suitable for network transmission, and necessary header information such as data packet type, length, target address, etc. can be added to these data packets.

[0105] Monitor the status of data packets during data transmission, including confirming whether the data packets are successfully sent, whether the receiver has confirmed receipt, etc. If a transmission error or data packet loss occurs, adopt the corresponding retransmission mechanism.

[0106] The encrypted data transmission method provided by the present disclosure mainly includes the following technical solutions: obtaining a data request instruction sent by a target user data management; wherein the data request instruction includes target card data; obtaining the target card data in a card data database, and encrypting the target card data according to a preset secret key and an encryption algorithm; wherein the preset secret key is calculated based on at least three secret key components; and sending the encrypted target card data to the target user data management. Compared with the related art, the embodiment of the present application adopts multiple secret key components to calculate the preset secret key, thereby enhancing the complexity of the encryption algorithm, reducing the risk of the secret key being cracked, and improving the card data security protection capability.

[0107] In some embodiments, before obtaining the data request instruction sent by the target user data management, the following steps are also included:

[0108] Acquire card data and store the card data in the card data database; wherein the card data database uses a preset encryption algorithm to uniformly encrypt all card data;

[0109] Please continue reading Figure 2 The number card center system will decrypt the received card data with K4 and then use the storage key 1 to adopt the SM4 national secret algorithm (i.e. internal algorithm) to encrypt and store all the data in the database. The storage key and transmission key of the number card center will be set to have a validity period (such as 3 years, 5 years, etc.), and the key will be replaced after expiration.

[0110] By separating the transmission key and storage key, as well as the key responsibility management in the transmission process of USIM card authentication data, and making the key invisible to operators, the card data security protection capability is improved and the security line of defense of card data is consolidated.

[0111] The acquiring the target card data in the card data database further comprises:

[0112] The encrypted target card data is obtained, and decrypted based on the preset encryption algorithm to obtain the original data of the target card data.

[0113] Please continue reading Figure 2 The card center decrypts the encrypted and stored card data to obtain the original data, and then encrypts it with the K4' secret key and AES algorithm and transmits it to the BOSS system (Business & Operation Support System).

[0114] See also Figure 3 , Figure 3 A schematic diagram of a flow chart of a method for transmitting encrypted data provided by an embodiment of the present disclosure includes:

[0115] Step 201, obtaining the key component for each user data management.

[0116] Please continue reading Figure 2 , extracting respective key components from different user data management systems. The key component is a part of generating the final preset key, and each user data management has multiple key components. In some embodiments, the transmission key K4' is composed of a provincial network component A, an IT component B, and a provincial market component C. The key component can be 128 bits, 192 bits, or 256 bits, which is not limited in the embodiments of the present application.

[0117] Different key components are obtained by different partial inputs. Even if one key component is leaked, the complete preset key cannot be recovered without other key components and algorithms.

[0118] Step 202: Generate a preset key corresponding to each user data management according to the key components of each user data management and a preset key generation algorithm.

[0119] The three departments enter one key component in the number card center respectively, and the number card center system automatically synthesizes K4' through a fixed algorithm. In this step, the system will use the key component obtained from step 201, combined with the preset key generation algorithm, to generate a unique preset key for each user data management.

[0120] The preset key generation algorithm may be a complex encryption algorithm, such as a hash function, a symmetric encryption algorithm, or multiple encryption techniques to ensure that the generated key has sufficient security. The generated preset key will be used to encrypt and decrypt the data of a specific user, ensuring that only the user data management system with the corresponding key can access and process the data.

[0121] The encrypting the card data according to the preset secret key and encryption algorithm also includes:

[0122] Obtain the target preset key corresponding to the target user data management;

[0123] The target card data is encrypted according to the target preset key and the encryption algorithm.

[0124] In this step, the target preset key corresponding to the target user data management is identified and extracted based on the preset key list generated previously, such as performing a search and mapping operation to ensure that the correct key is used for the correct user data management.

[0125] The target card data is encrypted using the acquired target preset key and the selected encryption algorithm. The selection of the encryption algorithm depends on a variety of factors, including the required security level, processing speed, data type, etc. This embodiment of the application does not limit this.

[0126] See also Figure 4 , Figure 4 A schematic diagram of a flow chart of a method for transmitting encrypted data provided by an embodiment of the present disclosure includes:

[0127] Step 301: Generate a first verification value of each preset key according to each key component of the user data management and a preset key generation algorithm.

[0128] The first check value of each preset key will be calculated using the key components of each user data management, combined with the preset key generation algorithm. The key components are the basic elements for generating the final key. They may include random numbers, timestamps, hardware identification and other information. These components are combined together through the algorithm to form a complete key. The first check value provides a quick way to verify the integrity of the key during the use, storage or transmission of the key. If the first check value matches the check value calculated in the subsequent verification process, the key can be considered safe; if it does not match, it may indicate that the key has been tampered with or damaged at some stage.

[0129] Step 302: Obtain the second verification value of each preset key sent by each user data management.

[0130] In this step, a second check value of the preset key is received from each user data management module. The second check value is usually a value calculated by a specific algorithm and is used to verify whether the preset key is consistent at both ends of the transmission. The second check value may be a hash value (such as SHA-256), a message authentication code (MAC) or any other form of checksum, which is not limited in the embodiment of the present application.

[0131] The received preset secret key is compared with its corresponding second verification value to verify the consistency of the secret key.

[0132] If the checksum matches, the system can confirm that the key is valid and has not been tampered with and can be safely used for encryption and decryption operations. If the checksum does not match, the system will take appropriate measures, such as refusing to use the key, issuing a security alert, initiating a key update process, or conducting further security audits.

[0133] Step 303: When it is determined that the first verification value and the second verification value of each preset key are consistent, it is determined that the verification is successful.

[0134] The previously generated first check value is compared with the currently calculated second check value to verify the integrity of the preset secret key. The calculated first check value is compared with the obtained second check value to determine whether the two check values ​​are completely consistent at the bit level.

[0135] If the first check value and the second check value are exactly the same, the system will determine that the check is successful, indicating that the preset key has not been tampered with during storage and transmission and can be used safely. If the check values ​​are inconsistent, the system will determine that the check has failed, which may mean that the key has been damaged or tampered with at some point. In this case, the system needs to take corresponding security measures, such as regenerating the key, notifying security management personnel, and recording security events.

[0136] In some embodiments, the USIM card supplier's card making system generates card data, including five-code data Ki: authentication key, OPc: algorithm configuration variable, IMSI: International Mobile Subscriber Identity, ICCID: Integrated Circuit Card Identification Code, SMSP: Short Message Center or part of the five-code data, etc. These card data are high-risk sensitive data. The card making system uses the SM2 asymmetric national secret algorithm and K4 key to encrypt the card data, and then transmits it to the first-level node of the operator's number card center after encryption, where K4 is the certificate of each party. The number card center system decrypts the received card data with K4 and then uses the storage key 1 to use the SM4 national secret algorithm to encrypt and store all data in the database, set the validity period of the storage key and transmission key of the number card center (such as 3 years, 5 years, etc.), and replace the key after expiration.

[0137] See also Figure 5 , Figure 5 A schematic diagram of a flow chart of a method for transmitting encrypted data provided by an embodiment of the present disclosure, wherein the method is applied to user data management, and includes:

[0138] Step 401, sending a data request instruction.

[0139] In some embodiments, user data management exchanges data with the number card center through the BOSS system, and sends a data request instruction to the number card center through the BOSS system to obtain user USIM card related data

[0140] Step 402, obtaining the encrypted target card data sent by the number card center.

[0141] Step 403: decrypt the target card data based on a preset secret key and encryption algorithm to obtain the original data of the target card data.

[0142] Step 404: Calculate an authentication vector based on the original data of the target card data, and perform user security verification based on the authentication vector.

[0143] In the user network authentication process, the UDM device uses the stored secret key K2 to decrypt the card data to obtain the original data, and uses the original data to calculate the authentication vector to complete the user security authentication.

[0144] The encrypted data transmission method provided by the present disclosure mainly includes the following technical solutions: obtaining a data request instruction sent by a target user data management; wherein the data request instruction includes target card data; obtaining the target card data in a card data database, and encrypting the target card data according to a preset secret key and an encryption algorithm; wherein the preset secret key is calculated based on at least three secret key components; and sending the encrypted target card data to the target user data management. Compared with the related art, the embodiment of the present application adopts multiple secret key components to calculate the preset secret key, thereby enhancing the complexity of the encryption algorithm, reducing the risk of the secret key being cracked, and improving the card data security protection capability.

[0145] In some embodiments, after obtaining the encrypted target card data sent by the number card center, the method further includes:

[0146] The card data is stored in the card data database; wherein the card data database uses a preset encryption algorithm to uniformly encrypt all card data.

[0147] Please continue reading Figure 2 , re-encrypt using the AES algorithm using the storage key K2 to generate new card data and store it in the database

[0148] In some embodiments, before decrypting the target card data based on a preset secret key and an encryption algorithm to obtain the original data of the target card data, the method further includes:

[0149] Generate a preset key and a second verification value of the preset key according to the key components and a preset key generation algorithm;

[0150] The second verification value is sent to the number card center.

[0151] In order to clearly illustrate a method for transmitting encrypted data provided in an embodiment of the present application, some implementation scenarios are used as examples for illustration below:

[0152] Scenario 1: Use of the second code in 2G. Figure 6 , Figure 6 A schematic diagram of a 2G authentication process provided in an embodiment of the present application includes:

[0153] Step 1: The card production center writes IMSI, Ki, etc. into the SIM card;

[0154] Step 2: When the terminal accesses the network, it initiates an authentication request to the local network, and the VLR (Visitor Location Register) forwards the request to the HLR (Home Location Register) module in the UDM;

[0155] Step 3: After HLR receives the authentication request from VLR, the system generates a random number RAND, and uses the A3 encryption algorithm to calculate the random number and Ki together to obtain the authentication value SRES (2G only involves two of the five codes, and the authentication vector is the triplet RAND, Kc (obtained from Ki and RAND through the A8 encryption algorithm), SRES), and sends the random number to the terminal at the same time.

[0156] Step 4: The terminal calculates an authentication response SRES' based on the received random number, combined with IMSI and Ki, and sends it to the MSC (Mobile Switching Center);

[0157] Step 5: The MSC finally compares the SRES received from the HLR with the SRES' sent by the terminal. If the two are consistent, the authentication is successful, otherwise the authentication fails.

[0158] Scenario 2: Use of three codes in 4G; see Figure 7 , Figure 7 A schematic diagram of a 4G authentication process provided in an embodiment of the present application includes:

[0159] Step 1: The terminal initiates an access request to the MME (Mobility Management Entity) through the eNB (enhanced Node B, 4G base station), carrying the IMSI;

[0160] Step 2: MME initiates an authentication request to the HSS (Home Subscriber Server) module in UDM, carrying the IMSI;

[0161] Step 3: HSS local database searches for IMSI to verify the legitimacy of the user. After verification, HSS uses IMSI, Ki, and OPC to generate a four-tuple authentication vector (RAND, XRES (Expected Response), AUTN (Authentication Token), KASME (a root key derived from the encryption key and the MME's public land mobile network number));

[0162] Step 4: HSS sends the authentication vector back to MME;

[0163] Step 5: MME stores the authentication vector, extracts RAND, AUTN, KASME, and assigns a key identifier KSIASME to KASME;

[0164] Step 6: MME sends a user authentication request to the terminal, carrying RAND, AUTN, and KSIASME.

[0165] Step 7: The terminal extracts and calculates the MAC (Media Access Control) related information in AUTN, calculates XMAC (Expected MAC), compares XMAC with the terminal's MAC to see if they are equal, and confirms that the network is legitimate. At the same time, check whether the SQN (sequence code) is within the normal range.

[0166] Step 8: The terminal sends a user authentication response to the MME, carrying RES. The MME compares the received RES with the XRES. If they are consistent, the authentication is passed and the network confirms that the terminal is legitimate.

[0167] Step 9: After two-way authentication, the MME and the terminal use KASME as the basic key to derive the encryption key CK and the integrity protection key IK.

[0168] Scenario 3: Use of three codes in 5G; please refer to Figure 8 , Figure 8 A schematic diagram of a 5G authentication process provided in an embodiment of the present application includes:

[0169] Step 1: UE (User Equipment) accesses the network and initiates an authentication request. AUSF (Authentication service function) determines whether the AMF (Authentication Management Function) is qualified to use the network. If so, AUSF initiates an initialization authentication process to UDM. UDM uses IMSI, Ki, and OPC to generate a four-tuple authentication vector, which includes RAND, AUTN, expected authentication response XRES*, and secret key KAUSF.

[0170] Step 2: UDM sends the authentication vector to AUSF and informs AUSF that the 5G AKA authentication method is used;

[0171] Step 3: After receiving the authentication vector from UDM, AUSF stores XRES*, SUPI (Subscription Permanent Identifier) ​​or SUCI (Subscriber Confidentiality Identifier), and KAUSF, and calculates the expected authentication response HXRES* and anchor key KSEAF through XRES* and KAUSF to generate the authentication vector RAND, AUTN, HXRES*, and KSEAF;

[0172] Step 4: AUSF removes KSEAF to generate RAND, AUTN, HXRES*, and sends them to AMF;

[0173] Step 5: AMF initiates the authentication process to the UE. The UE authenticates the network based on AUTN and confirms that the network is legitimate.

[0174] Step 6: The UE sends the authentication response parameter Authentication Response RES* to the AMF. The AMF calculates the expected authentication response HRES* through RES* and compares HRES* with HXRES* to determine whether the service network authentication is successful.

[0175] Step 7: AMF sends the authentication response parameter RES* received from the UE to AUSF. AUSF compares the received RES* with the stored XRES* for consistency. If they are consistent, the home network authentication is considered successful.

[0176] See also Fig. 9 , Fig. 9 A flow chart of a method for transmitting encrypted data provided by an embodiment of the present disclosure, wherein the system includes: a number card center and user data management, including:

[0177] Step 501: User data management sends a data request instruction.

[0178] Step 502, the number card center obtains the data request instruction sent by the target user data management; wherein the data request instruction includes the target card data.

[0179] Step 503: The card center obtains the target card data from the card data database and encrypts the target card data according to a preset secret key and encryption algorithm.

[0180] Step 504: the number card center sends the encrypted target card data to the target user data management.

[0181] Step 505: User data management obtains the encrypted target card data sent by the number card center.

[0182] Step 506: The user data management decrypts the target card data based on a preset secret key and encryption algorithm to obtain the original data of the target card data.

[0183] Step 507: User data management calculates an authentication vector based on the original data of the target card data, and performs user security verification based on the authentication vector.

[0184] The encrypted data transmission system provided by the present disclosure mainly includes the following technical solutions: obtaining a data request instruction sent by a target user data management; wherein the data request instruction includes target card data; obtaining the target card data in a card data database, and encrypting the target card data according to a preset secret key and an encryption algorithm; wherein the preset secret key is calculated based on at least three secret key components; and sending the encrypted target card data to the target user data management. Compared with the related art, the embodiment of the present application increases the complexity of the encryption algorithm by using multiple secret key components to calculate the preset secret key, reduces the risk of the secret key being cracked, and improves the card data security protection capability.

[0185] Corresponding to the above-mentioned encrypted data transmission method, the present invention also provides an encrypted data transmission device. Since the device embodiment of the present invention corresponds to the above-mentioned method embodiment, details not disclosed in the device embodiment can be referred to the above-mentioned method embodiment, and will not be repeated in the present invention.

[0186] Fig.10 A schematic diagram of a structure of a transmission device for encrypted data provided by an embodiment of the present disclosure, wherein the device is applied to a number card center, such as Fig.10 As shown, including:

[0187] The first acquisition unit 61 is used to acquire a data request instruction sent by the target user data management; wherein the data request instruction includes target card data;

[0188] An encryption unit 62, used to obtain the target card data from a card data database, and encrypt the target card data according to a preset secret key and an encryption algorithm; wherein the preset secret key is calculated based on at least three secret key components;

[0189] The sending unit 63 is used to send the encrypted target card data to the target user data management.

[0190] The encrypted data transmission device provided by the present disclosure mainly includes the following technical solutions: obtaining a data request instruction sent by a target user data management; wherein the data request instruction includes target card data; obtaining the target card data in a card data database, and encrypting the target card data according to a preset secret key and an encryption algorithm; wherein the preset secret key is calculated based on at least three secret key components; and sending the encrypted target card data to the target user data management. Compared with the related art, the embodiment of the present application increases the complexity of the encryption algorithm by using multiple secret key components to calculate the preset secret key, reduces the risk of the secret key being cracked, and improves the card data security protection capability.

[0191] Furthermore, in a possible implementation of the embodiment of the present disclosure, as Fig.11 As shown, the device also includes:

[0192] The storage unit 64 is used to obtain the card data and store the card data in the card data database before the first obtaining unit 61 obtains the data request instruction sent by the target user data management; wherein the card data database uses a preset encryption algorithm to uniformly encrypt all the card data;

[0193] The encryption unit 62 is also used for:

[0194] The encrypted target card data is obtained, and decrypted based on the preset encryption algorithm to obtain the original data of the target card data.

[0195] Furthermore, in a possible implementation of the embodiment of the present disclosure, as Fig.11 As shown, the device also includes:

[0196] A second acquisition unit 65, used for acquiring a key component for each user data management before the encryption unit 62 encrypts the target card data according to a preset key and encryption algorithm;

[0197] A generating unit 66, configured to generate a preset key corresponding to each user data management according to the key components of each user data management and a preset key generation algorithm;

[0198] The encryption unit 62 is also used for:

[0199] Obtain the target preset key corresponding to the target user data management;

[0200] The target card data is encrypted according to the target preset key and the encryption algorithm.

[0201] Furthermore, in a possible implementation of the embodiment of the present disclosure, as Fig.11 As shown, the generating unit 66 is further used for:

[0202] Generate a first verification value for each preset key according to each of the key components of the user data management and a preset key generation algorithm;

[0203] Obtaining a second verification value of each preset secret key sent by each user data management;

[0204] When it is determined that the first verification value and the second verification value of each preset key are consistent, it is determined that the verification is successful.

[0205] Fig.12 The structure diagram of a transmission device for encrypted data provided by an embodiment of the present disclosure is shown in FIG. Fig.12 As shown, including:

[0206] A sending unit 71, used for sending a data request instruction;

[0207] An acquisition unit 72, used for acquiring the encrypted target card data sent by the number card center;

[0208] A decryption unit 73, used to decrypt the target card data based on a preset secret key and encryption algorithm to obtain the original data of the target card data;

[0209] The security verification unit 74 is used to calculate an authentication vector according to the original data of the target card data, and perform user security verification according to the authentication vector.

[0210] The encrypted data transmission device provided by the present disclosure mainly includes the following technical solutions: obtaining a data request instruction sent by a target user data management; wherein the data request instruction includes target card data; obtaining the target card data in a card data database, and encrypting the target card data according to a preset secret key and an encryption algorithm; wherein the preset secret key is calculated based on at least three secret key components; and sending the encrypted target card data to the target user data management. Compared with the related art, the embodiment of the present application increases the complexity of the encryption algorithm by using multiple secret key components to calculate the preset secret key, reduces the risk of the secret key being cracked, and improves the card data security protection capability.

[0211] Furthermore, in a possible implementation of the embodiment of the present disclosure, as Fig.13 As shown, the device also includes:

[0212] The storage unit 75 is used to store the card data into the card data database after the acquisition unit 72 acquires the encrypted target card data sent by the number card center; wherein the card data database uses a preset encryption algorithm to uniformly encrypt all card data.

[0213] Furthermore, in a possible implementation of the embodiment of the present disclosure, as Fig.11 As shown, the device also includes:

[0214] A generating unit 76, configured to generate a preset key and a second verification value of the preset key according to a key component and a preset key generating algorithm before the decryption unit 73 decrypts the target card data based on the preset key and the encryption algorithm to obtain the original data of the target card data;

[0215] The sending unit 77 is also used to send the second verification value to the number card center.

[0216] It should be noted that the above explanation of the method embodiment is also applicable to the device of the embodiment of the present disclosure, and the principle is the same, which is no longer limited in the embodiment of the present disclosure.

[0217] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0218] Fig.14 A schematic block diagram of an example electronic device 800 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0219] like Fig.14 As shown, the device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a ROM (Read-Only Memory) 802 or a computer program loaded from a storage unit 808 to a RAM (Random Access Memory) 803. In the RAM 803, various programs and data required for the operation of the device 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An I / O (Input / Output) interface 805 is also connected to the bus 804.

[0220] A number of components in the device 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the device 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0221] The computing unit 801 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a CPU (Central Processing Unit), a GPU (Graphic Processing Units), various dedicated AI (Artificial Intelligence) computing chips, various computing units running machine learning model algorithms, a DSP (Digital Signal Processor), and any appropriate processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above, such as a method for transmitting encrypted data. For example, in some embodiments, the method for transmitting encrypted data may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the method described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to execute the aforementioned encrypted data transmission method in any other appropriate manner (for example, by means of firmware).

[0222] Various embodiments of the systems and techniques described above herein may be implemented in digital electronic circuit systems, integrated circuit systems, FPGAs (Field Programmable Gate Arrays), ASICs (Application-Specific Integrated Circuits), ASSPs (Application Specific Standard Products), SOCs (System On Chips), CPLDs (Complex Programmable Logic Devices), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs that may be executed and / or interpreted on a programmable system including at least one programmable processor that may be a special purpose or general purpose programmable processor that may receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0223] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0224] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a RAM, a ROM, an EPROM (Electrically Programmable Read-Only-Memory) or a flash memory, an optical fiber, a CD-ROM (Compact Dis sc Read-Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0225] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (Cathode-Ray Tube) or LCD (Liquid Crystal Display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball), through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0226] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: LAN (Local Area Network), WAN (Wide Area Network), the Internet, and blockchain networks.

[0227] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed system, or a server combined with a blockchain.

[0228] It should be noted that artificial intelligence is a discipline that studies how computers can simulate certain human thought processes and intelligent behaviors (such as learning, reasoning, thinking, planning, etc.), and includes both hardware-level and software-level technologies. Artificial intelligence hardware technologies generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, and big data processing; artificial intelligence software technologies mainly include computer vision technology, speech recognition technology, natural language processing technology, as well as machine learning / deep learning, big data processing technology, knowledge graph technology, and other major directions.

[0229] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0230] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for transmitting encrypted data, characterized in that: The method is applied to a number card center, and includes: Obtaining a data request instruction sent by a target user data management; wherein the data request instruction includes target card data; Obtain the target card data in a card data database, and encrypt the target card data according to a preset secret key and an encryption algorithm; wherein the preset secret key is calculated based on at least three secret key components; The encrypted target card data is sent to the target user data management.

2. The method according to claim 1, characterized in that Before obtaining the data request instruction sent by the target user data management, the method further includes: Acquire card data and store the card data in the card data database; wherein the card data database uses a preset encryption algorithm to uniformly encrypt all card data; The acquiring the target card data in the card data database further comprises: The encrypted target card data is obtained, and decrypted based on the preset encryption algorithm to obtain the original data of the target card data.

3. The method according to claim 1, characterized in that Before encrypting the target card data according to a preset secret key and an encryption algorithm, the method further includes: Obtain the key components for each user's data management; Generate a preset key corresponding to each user data management according to the key components of each user data management and a preset key generation algorithm; The encrypting the card data according to the preset secret key and encryption algorithm also includes: Obtain the target preset key corresponding to the target user data management; The target card data is encrypted according to the target preset key and the encryption algorithm.

4. The method according to claim 3, characterized in that The generating of a preset secret key corresponding to each user data management further includes: Generate a first verification value for each preset key according to each of the key components of the user data management and a preset key generation algorithm; Obtaining a second verification value of each preset secret key sent by each user data management; When it is determined that the first verification value and the second verification value of each preset key are consistent, it is determined that the verification is successful.

5. A method for transmitting encrypted data, characterized in that: The method is applied to user data management, comprising: Send data request instruction; Obtain the encrypted target card data sent by the number card center; Decrypting the target card data based on a preset secret key and encryption algorithm to obtain the original data of the target card data; An authentication vector is calculated according to the original data of the target card data, and user security verification is performed according to the authentication vector.

6. The method according to claim 5, characterized in that After obtaining the encrypted target card data sent by the number card center, the method further includes: The card data is stored in the card data database; wherein the card data database uses a preset encryption algorithm to uniformly encrypt all card data.

7. The method according to claim 5, characterized in that Before decrypting the target card data based on a preset secret key and an encryption algorithm to obtain the original data of the target card data, the method further includes: Generate a preset key and a second verification value of the preset key according to the key components and a preset key generation algorithm; The second verification value is sent to the number card center.

8. A transmission device for encrypted data, characterized in that: The device is applied to a number card center, and includes: A first acquisition unit, configured to acquire a data request instruction sent by a target user data management; wherein the data request instruction includes target card data; An encryption unit, used for obtaining the target card data from a card data database, and encrypting the target card data according to a preset secret key and an encryption algorithm; wherein the preset secret key is calculated based on at least three secret key components; The sending unit is used to send the encrypted target card data to the target user data management.

9. A device for transmitting encrypted data, characterized in that: The device is applied to user data management, including: A sending unit, used for sending a data request instruction; An acquisition unit, used for acquiring the encrypted target card data sent by the number card center; A decryption unit, used to decrypt the target card data based on a preset secret key and an encryption algorithm to obtain the original data of the target card data; The security verification unit is used to calculate an authentication vector according to the original data of the target card data, and perform user security verification according to the authentication vector.

10. A transmission system for encrypted data, characterized in that: The system includes: a number card center and user data management, wherein: The number card center is used for: Obtaining a data request instruction sent by a target user data management; wherein the data request instruction includes target card data; Obtain the target card data in a card data database, and encrypt the target card data according to a preset secret key and an encryption algorithm; wherein the preset secret key is calculated based on at least three secret key components; Sending the encrypted target card data to the target user data management; The user data management is used to: Send data request instruction; Obtain the encrypted target card data sent by the number card center; Decrypting the target card data based on a preset secret key and encryption algorithm to obtain the original data of the target card data; An authentication vector is calculated according to the original data of the target card data, and user security verification is performed according to the authentication vector.

Images